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APOLLO EXPERIENCE REPORT 
GUIDANCE AND CONTROL SYSTEMS: 

PRIMARY GUIDANCE, NAVIGATION. AND CONTROL SYSTEM DEVELOPMENT 

ByM. D. Holley, W. L. Swingle, S. L. Bachman, 

C. J. LeBlanc, H. T. Howard, and H, M. Biggs 
Lyndon B. Johnson Space Center 

SUMMARY 


The primary guidance, navigation, and control system development progressed 
in three increments: Block I (0), Block I (100), and Block n. The Block I (0) phase 
was devoted primarily to research and development and provided the design baseline. 
In the Block I (100) development, flight- qualified systems were produced. The Block 
n phase resulted in the final design and development of the flight systems for both the 
command module and the lunar module. 

The technological advances in the art of producing materials and components as 
a result of the program have been a benefit to space and military programs and have 
resulted in commercial applications. The integrity of the primary guidance, naviga- 
tion, and control system has been proved by its successful performance during the 
Apollo Block I and lunar missions. 


INTRODUCTION 


For convenience, this report is divided into five sections in which the basic ele- 
ments of the primary guidance, navigation, and control system (PGNCS) are discussed 
individually. These sections and the authors of each are as follows: "Inertial Subsys- 
tem, " M. D. Holley and S. L. Bachman; "Computer Subsystem, " H. T. Howard; "Opti- 
cal Subsystem, " C. J. LeBlanc; "Inertial Reference Integrating Gyro, " M. D. Holley 
and W. L. Swingle; and "Pulsed Integrating Pendulous Accelerometer, " H. M. Biggs. 

As an aid to the reader, where necessary the original units of measurement have 
been converted to the equivalent value in the Systeme International d*Unites (SI). The 
SI units are written first, and the original units are written parenthetically thereafter. 



INERTIAL SUBSYSTEIVl 


The Apollo inertial subsystem performed successfully on 10 lunar module (LM) 
flights, on 3 command module (CM) flights in the Block I configuration, and on 11 CM 
flights in the Block II configuration. This complex subsystem supported both unmanned 
and manned Apollo flights without an in-flight failure. 

The primary inertial subsystems used in both the LM and the CM were common 
with minor differences in packaging, scaling, and interfaces. These subsystems con- 
sisted basically of the electronics to drive and control, and a mechanical system to 
hold and position, a set of three orthogonally mounted accelerometers. The gyro and 
accelerometer histories are discussed in separate sections of this report. The iner- 
tial subsystem is divided into five major groupings: (1) the inertial measurement unit 
(IMU) containing three gimbals, gimbal- mounted electronic packages, resolvers, slip- 
rings, torque motors, and six inertial instruments; (2) the power and servo assembly 
(PSA) containing the power supplies, switching circuits, and servocontrol electronics; 
(3) the coupling data units containing the digital- to-analog and analog- to- digital conver- 
sion equipment; (4) the pulse electronics assembly containing the circuits required to 
generate the calibrated torquing pulses for the accelerometers; and (5) the guidance 
and navigation (G&N) interconnect control group, which includes the interconnecting 
harnesses and control panels. 

The design of the inertial subsystem required for the navigation and guidance of 
the Apollo spacecraft was a responsibility separate from spacecraft vehicle design. 
Early mission- error analysis indicated that accelerometers and gyros of the Polaris 
Mark II system had performance characteristics adequate for the Apollo lunar mission. 
The Apollo inertial system thus evolved from basic Polaris Mark II designs. This deci- 
sion was heavily based on the initial requirement for an Earth-orbital flightin late 1963. 


SYSTEM DESCRIPTION 


The Block II and LM inertial subsystems consisted of the IMU, the electronic 
coupling data unit (ECDU), the PSA, a navigation base, the pulsed integrating pendu- 
lous accelerometer (PIP A) electronics assembly (PEA) in the CM, and the pulse- 
torquing assembly (PTA) in the LM. 

The inertial subsystem equipment installed in the CM and its location relative to 
the other subsystems of the PGNCS are shown in figure 1. The navigation base is 
mounted to the spacecraft sidewall and is used as a holding fixture for the IMU and the 
optical assembly. The IMU and the optical assembly are attached and precisely alined 
to the navigation base. The lower display and control (D&C) panel comprises the front 
of the PGNCS structure and contains several individual panels. The panels with dis- 
plays and controls are located so the astronaut can view and manually operate the con- 
trols from a standing position. The PSA, which contains power supplies, amplifiers, 
and miscellaneous electronics, is mounted on a coldplate below the navigation base 
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and the indicator control panel. All PSA 
modules are plugged into a single flat 
interconnect- harness assembly, which is 
attached to the coldplate. Immediately be- 
low the PSA is the CM computer (CMC), 
and mounted at the left of the CMC is the 
coupling data unit (CDU). The PEA is 
mounted at the left of the IMU to reduce 
cable lengths for critical switching signals. 
The signal conditioners and one display and 
keyboard (DSKY) are mounted at the right 
of the optical assembly and the indicator 
control panel. The various hardware ele- 
ments are interconnected by a cabling 
harness. 

The inertial subsystem equipment 
installed in the LM and its location rela- 
tive to the other PGNCS subsystems are 
shown in figure 2. The navigation base is 
mounted to the upper structure at the front 
of the LM cabin and is used as a holding 
fixture for the IMU and the optical sensor. 
The IMU and the optical sensor are at- 
tached and precisely alined to the naviga- 
tion base. The LM guidance computer 
(LGC) and the ECDU are mounted on cold- 
plates located on the upper portion of the 
rear compartment wall. The PSA and the 
signal conditioner also are mounted on a 
coldplate and are located below the LGC 
and the ECDU. The PTA is mounted to 
the rear wall of the IMU compartment. 

The LGC DSKY, together with the other 
controls and displays, is located on the 
front wall of the LM cabin such that the as- 
tronaut can operate it while confined in 
his harness. 



Figure 1. - Location of the primary guid- 
ance and navigation system in the CM. 



Figure 2. - Location of the primary guid- 
ance and navigation system in the LM. 


The primary area of design departure from the Polaris Mark II guidance system 
was the need for functional crew interfaces such as displays and those interfaces re- 
quired for mode switching and realinement of the IMU. The conceptual design to de- 
fine these interfaces was accomplished in 1962. A complete systems review in 1965 
led to an integration of the guidance, navigation, and control (GN&C) functions to en- 
sure that alternate functional modes would be available in case of a failure in either 
the PGNCS or the stabilization and control system. 
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MAJOR SYSTEM FUNCTIONS 


The inertial subsystem performs three major functions: (1) measures changes 
in spacecraft attitude, (2) assists in generating steering commands, and (3) measures 
spacecraft velocity changes caused by thrust or atmospheric drag. To accomplish 
these functions, the IMU provides an inertial reference consisting of a stable member 
having three degrees of freedom that is stabilized by three integrating gyros. When 
the inertial system is operated before launch, the stable member is alined through a 
gyrocompassing routine; during flight, the stable member is alined by sighting the op- 
tical instruments on stars. If the inertial subsystem is operated for several hours, 
realinement may be necessary because the gyros that maintain the space- referenced 
stable member may drift and cause an error in flight calculations. 

Acceleration of the spacecraft is sensed by three pendulous accelerometers 
mounted on the stable member with their input axes orthogonal. The output signals 
from the accelerometers are used by the computer to update the spacecraft state 
vector. 


BLOCK I DESIGN HISTORY 


The design decisions concerning the inertial subsystems were heavily influenced 
by the plan (late 1961) to fly in 2 to 3 years. That period of time would not permit a 
complete new inertial system development. Thus, the design of the Block I inertial 
system was based on the Polaris Mark II system. Both the gyro and accelerometer 
used basic Polaris designs with minor mechanical and electrical changes. The early 
programmatic decisions also committed the Apollo inertial program to the competence 
and experience of the Polaris Mark II institutional and industrial team. The new areas 
of development were for the Apollo manned- mission design requirements of (1) in- 
flight optical alinement interface, (2) pilot moding interface, (3) general-purpose 
digital- computer gimbal- angle interface, (4) in-flight repair, and (5) packaging and 
interconnect wiring. 


Instrument Selection 

Detailed anal 5 dical work involving the relationship between inertial component 
performance and position and velocity dispersions could not begin until mission and 
trajectory profiles had been selected. However, as early as July 1961, preliminary 
estimates based primarily on the entry maneuver as the most demanding on the iner- 
tial subsystem indicated that Polaris Mark II instruments would meet the requirements. 

In November 1961, preliminary gyro performance specifications were estab- 
lished. Actual gyro error studies began early in 1962 with the entry maneuver because 
entry parameters were relatively well defined and the maneuver had critical operation- 
al requirements. Results for this mission phase were published in June 1962, followed 
by a study of lunar- orbit- insertion performance, the results of which were published 
in July. By early 1963, the Apollo mission definition was in a state that permitted 
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analysis of other mission phases, such as translunar injection, lunar landing, and 
lunar lift-off. The results of these studies were made available in March of the same 
year. At the same time, the errors involved in the process of fine- alining the IMU in 
space by means of the optical star sightings had been determined. An error budget 
applicable to the alinement process, including both IMU and optical errors, was pub- 
lished in February 1963. 

A specification for the PIPA performance requirements was issued in November 

1961. The adoption of the Polaris 25 inertial reference integrating gyro (IRIG) design 
for the Apollo spacecraft enabled the beginning of specification work on the pulse- 
torquing requirements, which were crucial in the mission because of the multiple in- 
flight alinements. Specifications were firm for the pulse- torquing electronics by May 

1962. 


The performance requirements for the inertial subsystem or indeed for the G&N 
system were never clearly specified during early program phases. The error analy- 
sis of the trajectories and early mission studies were done by the Massachusetts Insti- 
tute of Technology (MIT), and reasonable design specifications were formulated using 
the analysis results. From an inertial performance standpoint, an IMU error analysis 
revealed that moderate performance capability would suffice for manned missions. 
Because the most critical parameter was the gyro bias drift, which was the result of 
the long time between alinement and thrust termination, it was decided to conform to 
the Polaris inertial performance specification because of two factors: (1) the early 
flights were to be unmanned, thus not permitting the alinement, and (2) tighter per- 
formance would be indicative of higher reliability. 


Three-Gimbal -Platform Selection 

With an in-flight realinement concept and the recognition that all maneuvers for 
which the IMU was required would be in- plane maneuvers with little or no out-of-plane 
steering, it was reasoned that a three- gimbal system could be used. This configura- 
tion had several advantages over a four- gimbal IMU in terms of system complexity, 
weight, power, reliability, and cost. 

The function of the gimbal system is to support the gyros and the accelerometers 
on a structure that can be kept nonrotating in space despite rotations of the spacecraft. 
The motivation for having a four-degree-of-freedom gimbal system would be that such 
a configuration can be made and operated so that all attitudes of the spacecraft can be 
accommodated without the problem of gimbal lock, which can occur with a three- 
degree- of-freedom system. The questions posed in 1961 and 1962 were whether the 
simpler three- degree- of-freedom IMU would meet all the Apollo spacecraft attitude 
maneuvering requirements and whether the danger of gimbal lock would be high enough 
that a four- gimbal platform would be necessary. The answer in brief was that all nor- 
mal Apollo attitude maneuvers would be such that gimbal lock could be avoided by 
properly instituted operational procedures. The operation near gimbal lock in non- 
emergency maneuvers could be simply avoided. Direct means were available to warn 
of approaching difficulty so that corrective action could be taken. Finally, the pro- 
cedures for recovery from loss of alinement in emergency situations seemed straight- 
forward. 
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Although a strapdown or body- mounted inertial subsystem configuration was 
briefly examined at the start of the program, no serious consideration was given to 
this technique. The brief development time permitted by the schedule and the fact 
that no such body- mounted system was out of the laboratory experimental stage at that 
time precluded its use. Moreover, it was evident that schedules could be met by the 
development team only by using its experience with the design of the gimbaled IMU of 
the Polaris Mark II guidance system. 


Displays and Controls 

The conceptual development of the displays and controls for the astronauts was 
completed during 1962. This effort defined the useful system modes and the displays 
to be used. The onboard navigation techniques required a general-purpose digital com- 
puter having an attitude interface with the IMU. The analog- to- digital and digital- to- 
analog conversion technique initially selected was electromechanical. This electro- 
mechanized CDU became a basic element in displaying IMU gimbal angles to the crew- 
men and in commanding gimbal angles in a coarse-aline mode. Five coupling data 
units, one for each of the three IMU gimbals and one for each of two optical axes, were 
used. Each CDU, a servomotor, a resolver set, a digital encoder, three display dials, 
and a thumbwheel were all interconnected by a gear train. The gimbal and optics axis 
positions then could be repeated, displayed, and controlled by the crewmen or by the 
computer. 

Considerable effort was spent in making available to the crewmen as many back- 
up D&C modes as possible. Usage of segments of the system with other segments cur- 
rently operating was a ground rule. The use of the IMU as an attitude reference inde- 
pendent of the computer was also incorporated. An early attempt was made to incor- 
porate the capability for manual differential velocity (AV) steering by a visual monitor- 
ing of the Y- and Z-axis PIPA outputs. The astronaut would manually aline the IMU 
with the X-axis PIPA along the direction of thrust, then manually start and stop the 
engine, steer to maintain zero AV along the Y-axis and the Z-axis, and time the burn 
for the net AV gained. However, operational problems were encountered with the 
design and with production. Subsequently, in the middle of Block I production, the re- 
quirement for manual AV steering was dropped and the design was changed to reflect 
the deletion. Other backup modes were maintained but in ensuing flights were not 
used. All Block I flights were unmanned, and no capability to use backup modes was 
available. 


Packaging 

The driving factor in the design of packaging for the changed and new components 
from Polaris Mark II was the adoption of an in-flight maintenance capability where pos- 
sible. All five coupling data units were interchangeable and easily removable. The 
power supplies for the inertial subsystem, the servo loop, the components, and the 
electronic modules for each of the 6 inertial elements were packaged on 10 removable 
trays. Each tray contained removable modules, which were made as common as 
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possible and repeated for each gimbal loop or instrument. The IMU was not considered 
as a candidate for in-flight repair because its complexity, form factor, and alinement 
requirements were prohibitive for such an effort. 


Thermal Control 

Proper thermal control of the inertial instruments is of prime importance in 
achieving satisfactory performance. The Block I IMU temperature- control design was 
hampered from the start by an inadequate definition of the environment in which the IMU 
was expected to perform. In particular, the spacecraft thermal environment, primary- 
coolant- loop characteristics, and prime-power voltage excursions were unknown. For 
these reasons, an attempt was made to include much flexibility in the design to estab- 
lish the capability to adjust to the actual environments as they became better defined. 

The use of thermal- heat- of-fusion materials to serve as a heat reservoir was 
considered early in the design. This approach was taken to conserve electrical power. 
A thermal study, one of the first to define system operation for a lunar landing mis- 
sion, showed that, although this concept was sound, the use of these materials was 
unworkable based on IMU time-line usage. This approach was abandoned, and an elec- 
tronic temperature- control system was designed. 

The temperature- control scheme incorporated resistance- wire temperature- 
sensing elements located in the IRIG end mounts. Connected in series, these sensors 
measure the average temperature of the three gyros and form one arm of a four- arm 
resistance bridge. The remainder of the bridge is located in the PSA. The bridge 
error signal, proportional to the temperature difference between the actual average 
gyro temperature and the desired temperature, controls the operation of ma^etic am- 
plifiers in the PSA. In turn, these amplifiers provide power in proportion to tempera- 
ture deviation. The power is in the form of a 20- volt, 3200-hertz, pulse- width- 
modulated square- wave voltage to the stable-member heaters. 

An additional set of heaters, controlled by a thermostat on the stable member 
and powered directly from spacecraft primary power to the G&N system, comprises a 
redundant temperature- control system. This system does not provide the precise 
control of the primary system but is adequate to satisfy the crew- safety and mission- 
success requirements. 

Temperature- sensing thermistors within the gyros are used to monitor the gyro 
temperature. The thermistors are connected in series and form one arm of a four- 
arm space resistance bridge; the other elements of the bridge are located in the PSA. 
The error- signal output of this bridge controls a magnetic amplifier, which illuminates 
an alarm light if the gyro temperature exceeds specified limits. The amplifier also 
provides an output for telemetry of IRIG temperature and an output to the front of the 
PSA tray for use by the in-flight- failure monitor. The temperature- sensor resistance 
elements of the accelerometers are used to monitor pulsed integrating pendulum (PIP) 
temperature in a manner similar to that of the gyro temperature- monitoring scheme. 
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Two blowers on the middle gimbal are used to vary the thermal resistance be- 
tween the inner gimbal and the case. Saturable reactors on the outer gimbal vary the 
blower speed as a function of stable- member- heater power. 

The Block I PSA design consists of removable modules mounted on a vertical 
member of a removable tray. The requirement for in-flight maintenance together with 
the requirement for handling the modules and trays precluded the use of thermally con- 
ductive grease between the PSA trays and the coldplate. Consequently, the CM prime 
contractor developed a thermal interface material consisting of a rubberlike tubing 
(0. 32 centimeter (0. 125 inch) outside diameter) with a copper foil helically wound on the 
outside. This material was laid side by side to form a mat and was placed between the 
coldplate and the PSA. Late in the Block I program, the in-flight maintenance require- 
ment -was abandoned and a thermally conductive grease (Dow- Corning DC- 340) was used 
in conjunction with the thermal interface material to effect a better heat transfer. 


BLOCK I PROBLEMS 


In all parts of the inertial subsystem designed for in-flight repair, problems were 
encountered in meeting vehicle humidity requirements. In fact, the problems were 
solved only by changes that invalidated any in-flight maintenance capability. The elec- 
tromechanicad coupling data units were a prime example. To meet the humidity speci- 
fications, these mechanically precise rotating devices, matched for interchangeability, 
were placed in an environmentally sealed box and read through a window. A gasket 
seal could not be maintained for the large connector header into which the 10 PSA trays 
were mated, and a water-resistant grease was added. 


Angular Differentiating Accelerometer 

A problem arose during the acceleration test phase of the IMU qualification pro- 
gram. The IMU was mounted rigidly to the arm of a centrifuge. During the centri- 
fuge testing, the gimbals oscillated at the rotational frequency of the centrifuge. It 
became apparent that the angular differentiating accelerometer (ADA) mounted to the 
gimbal was nonrotating and, as such, was under the influence of a rotating accelera- 
tion. The ADA is a damped torsional mass that senses inertial angular acceleration. 
The device has a low pendulosity, preferably zero. With the low pendulosity, the re- 
sponse was as if the ADA were in inertial rotation with attendant stable- member mis- 
alinements. A review of operational requirements, however, revealed no rotating 
accelerations for any missions that would cause any problem. The decision to use the 
ADA was based on a Polaris servo design that was removed early in the Polaris devel- 
opment program. Subsequently, a new servo design that did not include an ADA was 
incorporated into the Block n system. 


Thermal Interface 

A major mechanical difficulty in the Block I PSA was achieving an adequate ther- 
mal interface between the PSA trays and the spacecraft coldplate. Tests of the thermal 
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interface material showed that thermal conductance varied in direct proportion to the 
depth of its compression. Other tests indicated that the contact pressures required 

for deflecting the material to achieve the desired conductance (568 W/m K (100 Btu/ 

2 

hr/®F/ft )) were much higher than originally anticipated. These forces caused bowing 
at the trays and plate; this condition reduced conductivity across local areas on the in- 
terface. Establishing appropriate tolerances for the tray locating tongues, stiffening 
of the trays, and changing the toeplate material from aluminum to beryllium produced 
an adequate but marginal design. However, not until the in-flight maintenance concept 
was dropped, thus permitting the use of conductive grease on the thermal interface 
material, was the problem adequately solved. 


Design Changes 

The PSA module designs were plagued by numerous modifications required by 
circuit and component changes. Scheduling constraints dictated a release to production 
concurrent with engineering evaluation testing. Nearly all the required modifications 
resulted from circuit changes dictated by this testing. Component changes were made 
to optimize circuit design parameters or to obtain higher reliability. Wiring and com- 
ponent placement were altered to minimize electromagnetic coupling between circuits. 
Circuit changes were also made when the original design was found to be marginal 
under adverse operating conditions. In some instances, high-power-dissipation com- 
ponents were relocated to remove local hotspots. When possible, the changes were 
made as a "repair fix" by deporting or by rework of manufactured modules with the 
necessary changes being incorporated into forward production. Where changes were 
too extensive, modules were scrapped and replaced with new designs. The change 
from ternary to binary torquing of the PIPA units also required new module design. 


In-Flight Maintenance 

The Block I in-flight module replacenient feature required that the modules be 
removed using only a number 10 Allen wrench. The modules were fastened to the trays 
with number 10 captive Allen- head bolts, which were reduced in thickness, or "necked 
down, " near the bolthead to provide clearance through a threaded portion of the module. 
Numerous bolt failures in the early systems were caused by shearing of the boltheads. 
Necking- down the bolts left an insufficient wall thickness in the region between the bolt 
shank and the Allen- head recess. A bolt configuration change to increase the material 
thickness in that region and a change to a stronger bolt material solved this problem. 


I MU Mechanical Resonance 

The IMU models were vibrated at one-g, 2g, and 3g (rms) sinusoidal input with 
a logarithmic frequency sweep from 20 to 2000 to 20 hertz in 16 minutes along each 
axis. Each IMU was also vibrated with a 5g (rms) random-noise input along each axis. 
The results of these tests indicated resonant frequencies in the range of 110 to 170 
hertz having transmissibilities of 7 to 22. 


As a result of high magnification seen at the resonant frequency on the Block I 
IMU, fatigue cracks developed in the middle- and outer- axis stub shafts. The stub 
shafts were redesigned, and vibration dampers were added to each axis in the torque- 
motor intergimbal assemblies. 

Strain- gage test results indicated a reduction in the stub- shaft stresses by a 
factor of 3. This stress reduction, together with the reduction of the transmissibility 
by the addition of dampers, resulted in a reduction of the stresses in the stub shafts to 
a level well below the fatigue limit of the material. A friction damper was added at 
the floated bearings. 


Lexan Case 

When the IMU gimbal- mounted electronic packages were designed, it was thought 
that an added measure of quality control could be achieved if the modules were encap- 
sulated in transparent potting material. It was reasoned that if one could see inside 
the module, greater care would be taken in the assembly of the module and that fact 
would add to the reliability of the assembly. The cordwood assembly was packaged in- 
side a transparent Lexan case and then potted with a transparent potting material. The 
Lexan cases exhibited a high incidence of cracking and crazing, and numerous attempts 
to solve the crazing problem proved futile. Finally, a drawn aluminum case was de- 
signed for the gimbal- mounted electronics, and the visual inspection feature was 
abandoned. 


Humidity-Proof Modules 

Block I PSA modules were packaged using a black- anodized aluminum housing 
and two types of encapsulation materials. The bottom end of the module was encapsu- 
lated with solid polyurethane, and the remainder of the module was encapsulated with 
polyurethane foam. After encapsulation, the bottom of the module was machined to 
obtain the required dimension from the Ixjttom of the module to the bottom of the con- 
nector. An examination of several modules that failed during humidity qualification 
testing disclosed that the solid polyurethane had separated from the housing and allowed 
moisture to penetrate the module. An engineering investigation determined that the 
adhesion of solid polyurethane to black- anodized aluminum was at best marginal because 
contaminating agents were present in sufficient quantities to prevent adhesion. The 
forces imparted by the milling cutter during the machining operations were found to 
cause separation where low peel strength existed. Satisfactory adhesion was obtained 
by first priming the aluminum housing with a thin coating of C7 epoxy adhesive. This 
change was incorporated in all subsequent production modules. In addition, greater 
emphasis was placed on cleaning and handling operations to ensure that module compo- 
nents were free of contamination. The module machining technique was revised to 
prevent the imparting of abnormal peel forces to the assembly during the milling 
operation. 
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Cold -Flow Teflon 


Block I hardware short circuits were experienced in the PSA tray header wire 
resulting from cold flow of the wire insulation. This phenomenon occurs when a Teflon- 
insulated wire is subjected to small but constant pressure against a sharp corner, such 
as a wire- wrap pin, a mounting boss, or a thermal island. This continuous pressure 
does not result in immediate cutting of the insulation but rather in gradual regression 
of the insulation. Proper selection of new wire- insulation materials, such as polyim- 
ides, that were more resistant to cold flow and still compatible with the encapsulant 
material in the wire- wrap plane alleviated the problem. 


Coupling Data Unit Gears 

The problems associated with the Block I CDU were mechanical. The gear trains 
used with the CDU exhibited excessive wear, and a few units "froze" in operation. To 
correct this failure mode, a carefully selected lubricant was added to the gears. An- 
other gearbox- associated failure occurred in the motor- tachometer supplied by one of 
the two vendors of this component. Because of mechanical tolerances, the motor- 
tachometer froze at elevated temperatures. The corrective action for this failure was 
to select the motor-tachometer from the vendor whose product did not exhibit this fail- 
ure mode. 


BLOCK II CHANGES 


As the Apollo spacecraft development became more advanced, a number of fac- 
tors made a block change of design desirable. From the beginning, a block- change 
concept was visualized as being inevitable because the Block I design was created in 
the absence of many necessary guidelines and specifications. In July 1962, the lunar 
landing concept was changed from the Earth- orbital- rendezvous to the lunar- orbital- 
rendezvous technique. In the fall of 1963, it was decided that a common system would 
be used to provide navigation, guidance, and control for both the LM and the CM. 

Thus, the LM concept made an obvious block- change point for the inertial subsystem 
of the CM also. 

In June 1964, the development contractor was directed to proceed with a Block II 
PGNCS design for the CM as well as for the LM. For both vehicles, the system was 
given direct interfaces with the gimbaled primary propulsion systems and with the re- 
action control jet clusters. Major Block II inertial subsystem changes are described 
in the following paragraphs. 

I MU Size Change 

The common inertial subsystem made weight an even more important considera- 
tion. After studying the possibilities, it was recommended that, while keeping the 
same stable member, the IMU weight could be reduced by approximately two- thirds 
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witha corresponding reduction in diameter from 35. 5 to 31 centimeters (14 to 12 inches). 
The resolver- chain simplification that accompanied the CDU changes permitted a re- 
duced number of resolvers. The combining of 1- and 16- speed resolvers onto the same 
rim reduced the number of resolvers by three, leaving only one resolution unit and 
three angle- measuring units in the IMU. The removal of three torque motors and the 
angular differentiating accelerometers and ADA amplifiers made possible the shrink- 
age of the intergimbal assemblies to reduce the overall IMU weight and size. The 
temperature- control system was simplified and, thereby, the quantity of gimbal- 
mounted electronic components was reduced. The IRIG was designed to have more 
compact realinement hardware by incorporating the preamplifier into the end- cap hard- 
ware. The PIP suspension module was redesigned as an integral assembly having a 
connector that would allow easy assembly of the PIP into the IMU. 


PEA/PTA Package 

The LM accelerometer package installation presented significant problems in view 
of the 5. 2 meters (17 feet) of cable between the IMU and the PSA or the proposed PIPA 
electronics location. A location near the IMU and in a coldplate with better temperature 
control was desired. Discussions with the LM prime contractor revealed that it was 
possible to put the accelerometer electronics in an assembly in the vicinity of the IMU 
and also to have its coldplate in series following the IMU and, thus, to achieve a lower 
coldplate temperature and a lower temperature deviation of the heat sink. This revela- 
tion suggested the possibility of modifying the CM in the same manner. Approval of 
the ECDU for incorporation left the old CDU coldplate, which was in series right after 
the IMU in the coolant loop, available. Use of this coldplate provided a colder, better 
controlled heat sink. Because the Block n design was to be humidity proof, the con- 
cept of a sealed assembly was introduced. This step necessitated several changes in 
philosophy with respect to the accelerometers. Module interchangeability was no long- 
er required. Finally, because of the sealed accelerometer electronics package, larger 
average values of bias and scale factor were permitted and the computer compensation 
range was changed accordingly. 


Gyro Drift 

The most sensitive performance parameter for the gyro in the Apollo mission 
was the bias drift. To optimize gyro performance, several changes in the gyro elec- 
tromagnetic characteristics were made. First, a stiffer radial suspension could be 
incorporated as well as additional axial suspension. This modification would reduce 
the geometrical changes of the float with respect to the case. Second, the Block I gyro, 
when pulse- torqued, required two reset pulses to restore the magnetic state of the rim 
and the resulting torque to its original value. Redesign of the torque generator to in- 
clude a reset winding made the application of reset pulses unnecessary. Third, a bias- 
compensation winding was added to correct for the total gyro bias drift and to provide 
compensation for tracking changes in electromagnetic reaction torque caused by sus- 
pension and changes in signal current and voltage. A more efficient signal generator 
was also added. The gyro wheel package was not changed, but the prealinement hard- 
ware was redesigned because the torque changes necessitated adding the IRIG pream- 
plifier and other components. 
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Power and Servo Assembly Repackaging 


The PSA required repackaging because of the form factor changes in the CM and 
the addition of the LM concept. These were essentially two different PSA units, al- 
though they carried many com.mon modules. The LM design was straightforward, but 
the CM location and size determinations presented more difficulty. Whereas the GN&C 
development contractor desired integral cooling, the CM prime contractor remained 
opposed to the concept. Finally, a compromise configuration was accepted that con- 
sisted of a flat PSA with the coldplate on top and attached through flexible hoses to per- 
mit installation. The size of the Block n PSA was ultimately reduced by the removal 
of the pulse torque electronics and the CDU electronics. 


Block II Coupling Data Unit 

Repeated difficulties in manufacturing and operational failures of the electrome- 
chanical CDU initiated an effort in 1963 to replace the unit with an all- electronic CDU. 

A resolver reading system breadboard was fabricated and demonstrated. The weight 
saving of 8. 2 kilograms (18 pounds) and a potential reliability improvement were the 
major factors in the decision to incorporate the ECDU. Subsequently, the incorpora- 
tion of a digital autopilot and other components into both the CM and the LM increased 
the weight. 

The new ECDU and Apollo guidance computer (AGC) made numerous moding 
changes necessary and desirable. Except for IMU turn-on and coarse alinement, IMU 
cage was to be the only manual mode; everything else was to be moded by the AGC. 

The PIPA units were to be activated only when both the IMU and the AGC were in oper- 
ation; in this manner, the problem of PIPA gaussing (change in magnetic characteris- 
tics) as a result of incorrect power turn-ons would be avoided. 

A design effort was undertaken to develop a smaller, lighter, simpler, more re- 
liable temperature- control system for the Block II IMU. Advantage was taken of the 
knowledge and experience gained from the Block I design. The Block II spacecraft was 
thermally similar to the Block I vehicle; therefore, the IMU environment was well 
known. A good thermal model of the IMU was developed from the Block I experience. 
The uncontrolled IMU heat sources (e. g. , inertial components, torquers, resolvers, 
and gimbal- mounted electronics) were well defined. 

The Block II system incorporated a mercury- thermometer thermostat that was 
used for Block I emergency temperature control. This thermostat, which had a very 
small deadband, proved to be accurate, stable, and extremely reliable. The Block II 
IMU temperature- control system performed the same functions as the Block I system 
except that it did not provide monitoring signals of IRIG temperature for telemetry. 

In the Block II system, temperature is controlled by using a mercury thermostat 
as the temperature- sensing element in a bistable temperature- control system. Addi- 
tional mercury thermostats are used for providing an out- of- limits temperature alarm 
indication and for controlling the two blowers. Each blower, which extends the dynamic 
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range of operation, is limit- cycled by a thermostat. Two separate sensors that detect 
out- of- limits temperature are used to caution the astronaut should this condition occur. 
In addition, high- temperature- limit mechanical thermostats are used in every heater 
powerline to prevent overheating. These thermostats are set to open the heater power 
at a temperature approximately 5 K (5° C) above the nornial control temperature. 

These thermostats have rarely been used; however, when necessary, they have pre- 
vented damage to valuable equipment. 


BLOCK 1 1 ANDLM PROBLEMS 


The major problems of the Block n and LM inertial subsystem appeared in the 
newly designed and changed items. As would be expected, the only electronic assembly 
entirely new to the inertial subsystem, the ECDU, had the major difficulties. 


Structural Problems 

A structural problem appeared during the environmental design evaluation of the 
Block n ECDU. The response of the modules within the headers to vibration or shock 
inputs from the spacecraft structure was higher than anticipated. A corrugated metal 
damper plate was placed between the two arrays of modules to help restrain the modu- 
lar response. Installation of this damper plate decreased the module resonance peaks 
to reasonable levels with a sufficient margin of safety. 

The mechanical interface chosen for the IMU mount in the LM led to a complex 
mounting solution. A tubular aluminum navigation base was used to ensure alinement 
control between the alinement optical telescope (AOT) and the IMU. These three units, 
designed by the GN&C development contractor, were then mounted to the basic vehicle 
structure by an angular aluminum navigation base designed by the LM contractor. The 
basic softness of the combination design mount together with the large moment arms 
of the masses mounted led to structural failure during qualification testing. Two re- 
designs were necessary. The last redesign, accomplished after a system- resonance 
study by the PGNCS manufacturing contractor, included a tubular sleeve construction 
in place of welded connections. 


Function Problems 

The operation of the Block II ECDU, in a system configuration, disclosed two 
problems that required design changes. The coarse-fine crossover for the ECDU was 
originally designed to take place at a maximum coarse error of 9° . System tests 
showed that, under certain conditions, an oscillatory limit- cycle condition developed 
between the coarse and fine systems. A design change made to reduce the crossover 
point to 7. 5® from null corrected the problem. 

The ECDU contained capacitor- coupled transistor switches as shown in figure 3. 
Immediately following power application or after long periods of inactivity, the direct 
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current (dc) charge that would normally 
accumulate on the capacitor would not be 
present or would have "leaked off. " When 
switching action was initiated, the charg- 
ing action of the coupling capacitor in con- 
junction with the frequency response of 
the operational amplifier would create a 

low-frequency "bounce" on the output of Figure 3.- Capacitor- coupled transis- 

the switch. The cumulative effect of sev- tor switch circuit diagram, 

eral switches being activated during 
coarse alinement of the IMU would cause 
the input-limiting diodes of the error am- 
plifier to be driven into the active region 
and effectively short circuit the alterna- 
ting current (ac) error signal to the ampli- 
fier as shown in figure 4. 

With loss of this error signal, the 
read counter would not increment and the 
feedback pulses to the digital- to- analog Figure 4.- Error amplifier circuit 

converter (DAC) error counter would not diagram, 

exist. The AGC would "load" the DAC er- 
ror counter to perform the coarse aline- 
ment and, in the absence of the feedback pulses, to subtract the "loaded" angle; when 
the gimbals moved, the error counter would overflow on subsequent computer com- 
mands and thus result in a loss of information to the ECDU and a failure to achieve the 
commanded ECDU angle. 

The diodes were removed and the error amplifier modified to improve its satu- 
ration characteristics. In this manner, a larger linear operational region was 
produced. 

Component Problems 

Several component- associated problems were encountered in the Block II ECDU 
during the manufacturing period. The part types that exhibited failure modes were 
(1) micrologic circuits, (2) transistors, (3) transformers, (4) capacitors, (5) relays, 
and (6) resistors. 

The micrologic NOR gates used in the digital modules of the ECDU exhibited both 
"open" gate failures and "shorted" gate failures during subassembly testing at the in- 
ertial subsystem contractor's plant. The majority of the failures occurred during vi- 
bration tests. The failures induced by the vibration of the modules were attributed to 
contaminants within the micrologic flatpack. A "screening" vibration test was con- 
ducted at the module manufacturing facility to remove this mode of failure. The vibra- 
tion "screening" consisted of vibrating the micrologic flatpacks along three perpendic- 
ular axes to eliminate those modules containing contaminants. 
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The transistor used in the ECDU ac switches was a 2N2351 device. During the 
program, this transistor exhibited failure modes that were attributed to the deteriora- 
tion of gold- aluminum internal bonds (called "purple plague") and to internal contami- 
nation. The corrective action was to institute a centrifuge and X-ray inspection for 
incoming transistors at the inertial subsystem contractor's plant and to improve clean- 
ing procedures at the manufacturer’s facility. A second source of supply was also ob- 
tained for parts procurement. 

Transformer failures occurred through two different modes. The transformer 
used in the main summing amplifier exhibited inductance shifts after the module was 
potted. The inductance shift was caused by lamination shifts within the transformer 
and was corrected by an improved method of sealing the laminations. The other mode 
of transformer failure was associated with wire breakage inside the transformer. The 
wire used to wind these transformers was # 50 AWG. The internal stresses placed 
on the wire terminations and on the fine wire used to wind the transformer were be- 
lieved to be caused by the hard potting compound used in the transformer. The correc- 
tive action was to replace the transformer with a compatible unit wound with larger 
wire. 


Failure modes of the capacitors used in the ECDU were associated with two types 
of capacitors. One capacitor exhibited high- leakage characteristics after being potted 
in a module and after being subjected to vibration testing. Because this failure mode 
was found to be predominantly associated with one manufacturer’s capacitor, the cor- 
rective action consisted of not using this product in the construction of the ECDU. The 
other capacitor was a polystyrene film unit, which exhibited film rupture resulting in 
shorted units and poor connections to the film for external leads. The corrective ac- 
tion consisted of replacing the polystyrene unit with a polyamide capacitor. 

The relays used in the ECDU for DAC output transfers were the electromagnetic- 
sensitive type. Contamination of the relay by solder balls produced failures of these 
units in the initial stages of ECDU manufacturing. Subsequent improvements in proc- 
essing, cleaning, and inspection procedures by the manufacturer reduced this failure 
mode as a problem. 

Failures associated with resistors were confined to the high- resistance- value 
metal films and to the carbon resistors used in the main summing amplifiers. The 
metal film resistors were found to have changing values under module rework. It was 
concluded that the abrasive material used during deporting was establishing a high elec- 
trostatic voltage on the resistors and in turn was punching through and/or changing the 
metal film characteristics of the resistor. The corrective action was changing the 
type of abrasive material used during the deporting process. When potted, the carbon 
resistors, only two of which are located in each ECDU axis, exhibited a drift charac- 
teristic that forced their resistance values outside the specified limits. The correc- 
tive action for this phenomenon consisted of changing the specification to accommodate 
the drift. These resistors occupied a noncritical position in the ECDU function; hence, 
the specification variance could be tolerated. 
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IVIAJOR TESTS 


The design environment within which the G&N system was required to operate 
was defined in interface control documents negotiated among PGNCS development con- 
tractors, the two spacecraft contractors, and the NASA. The design environments in- 
cluded such parameters as acceleration, vibration, shock, temperature, humidity, 
pure oxygen atmosphere, electrical input power, and pressure. Because these docu- 
ments were negotiated early in the program when the anticipated environments were 
largely unknown, the interface control document design limits were generally con- 
servative. 

Design evaluation testing was performed early in the design phase on mockups, 
prototypes, and first- article development hardware to ensure that the equipment as 
designed did indeed have the integrity and the capability to meet and exceed perform- 
ance requirements and to determine and define margins and limitations of the design 
in excess of requirements. The design of each element was rigorously examined with 
regard to thermal evaluation, mechanical integrity, marginal voltages, vacuum, func- 
tional and operating characteristics, stability, alinement, system integration, aixJ 
interface requirements. Other peculiar characteristics or environments to which a 
particular element was sensitive, such as humidity, salt, contaminants, and electro- 
magnetic interference, were also examined. 

A formal qualification test program was established to provide maximum assur- 
ance that the G&N equipment would perform its required functions under the environ- 
mental conditions for the Apollo mission. The Apollo Airborne Guidance and Naviga- 
tion Qualification Specification identified the elements of the G&N system and the block 
configuration to be qualified to each type of environmental stress level. In general, 
the total G&N system was qualified to nominal mission levels and the subsystems and 
subassemblies were qualified to design levels with overstress in critical environments. 
Parts were qualified to a design level with emphasis on ability to determine part qual- 
ity. The qualification criteria for parts were established by (1) the expected maximum 
stress level anticipated in the worst- case system application, (2) an adequate margin 
of safety, and (3) the degree to which a measure of quality in the manufacturing tech- 
niques was desired. 

Separate testing programs were performed for the IRIG and the PIPA. These 
testing programs are discussed in the sections of this report entitled "Inertial Refer- 
ence Integrating Gyro" and "Pulsed Integrating Pendulous Accelerometer, " respec- 
tively. 


COMPUTER SUBSYSTEM 


The computer subsystems used for the Apollo CM and LM are described in this 
section. The Block II CM computer subsystem consists of one AGC and two DSKY as- 
semblies; the LM computer subsystem consists of one AGC and one DSKY. In both 
cases, the AGC and the DSKY assemblies are identical except that the LM DSKY has 
two additional status displays. 
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In the operational configuration, which was used for the lunar landing mission, 
the computer subsystem included the AGC, the DSKY, and six fixed- memory modules 
designated "ropes. " During the mission phases in which acceleration maneuvers are 
performed, the AGC accepts inputs from the IMU, which provides attitude data and 
measures velocity change. This information is processed by the AGC and is used to 
steer the vehicle and to compute position and velocity. During nonthrusting phases of 
the mission, the system is concerned with navigational computations (i. e. , determina- 
tion of position and velocity) from which required trajectory changes can be determined 
and made. 

The PGNCS consists cl elements to provide sensing, display, manual controls, 
and spacecraft steering control modes. In all modes, the computer provides the func- 
tions of mode control, display of information, and computation. Manual control com- 
mands are entered by means of the DSKY, an optics mark button, and hand controllers 
for manual engine control inputs. 

Each spacecraft (LM and CM) has a guidance system, and each contains one of 
these computers. Although the guidance systems of the two vehicles are similar, dif- 
ferent functions are performed in each vehicle; however, the computers are identical. 
The interconnection between the equipment and the different programs stored in the 
computer provides for the different functions required. The CM has two DSKY assem- 
blies, one on the main spacecraft display panel and one in the lower equipment bay 
where the PGNCS is located. In the LM, the single DSKY is mounted on the space- 
craft display panel. 


DESIGN 


The AGC is the descendant of a series of computer designs intended for a pro- 
posed space vehicle designed to photograph Mars and return by means of a self- 
contained G&N capability. The Mars machine, although never actually built, was de- 
signed to use magnetic- core and transistor logic. The instruction repertoire, word 
length, and number of erasable- memory cells were all small. Provisions were made, 
however, for a moderately large amount of fixed memory for instructions and con- 
stants. A high-density memory of the read-only type, called a rope memory (because 
of the ropelike wire weaving through the magnetic cones), was developed especially for 
this purpose. Rope memories were used in the AGC because of their high density and 
information- retention advantages, although this usage placed a burden on software de- 
livery schedules because of the time required for their manufacture and on system in- 
tegration and testing because of their inflexibility. 

Other important aspects of the Mars computer of evolutionary significance were 
the incorporation of a method of accommodating real-time inputs and outputs that were 
unusual at that time and the use of an interpretive program. Real-time inputs and out- 
puts were accomplished by the program-interrupt method. The use of interruptions in 
various forms was an important addition to the aerospace computer field and was a ma- 
jor attribute of the AGC. The interpretive program is a means of trading off execution 
time with instruction repertoire. This technique allows use of a restrictive basic set 
of instructions, with the more powerful instructions actually being executed by sub- 
routines. 
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The first AGC, designated AGC3, consisted of 1024 words of erasable memory 
and 12 288 words of rope memory and was capable of executing 11 basic instructions. 
Normal instruction- execution time was 40 microseconds, of which approximately 20 
microseconds were consumed by the two memory- access cycles required to fetch (or 
store) instructions and data. The remaining time was occupied in manipulation and 
transfer of numbers among the central and special registers, which included the adder 
and various buffering and editing registers. 

The editing and input/output operations, which are commonly handled by special 
instructions, were handled by special memory cells. For example, to shift a word in 
this family of machines, the word is stored in a special register dedicated to this pur- 
pose and is read out again. The shifting is accomplished between storing and reading. 
This technique sacrifices memory for hardware and is essential for cases in which the 
instruction list is severely limited. 

During the evolutionary period of these computers from 1958 to 1962, the hard- 
ware technology available to the aerospace computer designer was rapidly evolving. 

A three-dimensional magnetic- core array had been designed and adapted to meet the 
Apollo vibration environment. 

Another important line of evolution was semiconductor technology, in which sili- 
con transistors progressed first to planar and then to epitaxial form and monolithic in- 
tegrated circuits were developed. Still another area of development was packaging, in 
which the introduction of welding and matrix- interconnection techniques allowed signifi- 
cant reductions in volume and weight over previous circuit- board techniques while en- 
hancing reliability. The welding techniques and some of the silicon transistor technol- 
ogy mentioned were used by the GN&C development contractor in the development of 
earlier computers. These techniques were applied more or less directly to the Apollo 
computer design. 

Integrated circuits were in development by the semiconductor industry during the 
late 1950's under U. S. Air Force sponsorship. In late 1961, a number of integrated 
circuits were procured for evaluation as candidates for the AGC. An integrated cir- 
cuit was constructed to reveal any problems the units might present when used in 
large numbers. Reliability, power consumption, noise generation, and noise suscep- 
tibility were the primary subjects of concern. The performance of the units under 
evaluation was sufficiently good to justify their exclusive use in place of core- transistor 
logic, except for a portion of the erasable- memory addressing circuitry in which metal 
tape cores were retained as a medium for current switch selection. Accordingly, the 
AGC Block I computer was designed to use integrated- circuit logic. 

The first rack-mounted AGC emerged in late 1962 with integrated- circuit logic, 
rope fixed memory, coincident- current- core erasable memory, and discrete- 
component circuits for oscillators, power supplies, selected alarms, interface and 
memory driving, and sensing. The rope memory contained 12 288 words, but this fig- 
ure was shortly raised to 24 576 words, a revision made possible by designing the rope 
modules with the eventual ejqjansion in mind. No particular mission need for this ex- 
pansion had been identified other than an uneasiness about the possible insufficiency of 
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the 12 000- word memory. Within a year, when the first mission program require- 
ments had been conceived, documented, and collected, concern about the possible in- 
sufficiency of the 24 000- word memory prompted a further expansion in the Block n 
computer to 36 000 words. 

The erasable memory contained 1024 words, of which the first 16 were central 
and special registers contained as flip-flops in the logic of the computer rather than in 
the core memory unit. Both fixed and erasable memories were operated at a cycle 
time of approximately 12 microseconds. This cycle was quite leisurely for the eras- 
able memory and permitted time between reading and writing for content modifica- 
tion such as incrementing and shifting needed for memory- cycle- stealing operations. 
The rope memory is inherently slow and was operating much less leisurely. No hier- 
archical distinction was made between the fixed and erasable memories; both were ac- 
cessible by any instruction. The instructions written into memory would of course 
fail to alter the contents of fixed memory. 

The integrated- circuit logic section for Block I was composed solely of three- 
input NOR gates, with one gate in each TO- 47- style transistor package (can). These 
gates were relatively simple in form, consisting of the equivalent of three n-p-n bi- 
polar transistors and four resistors connected as a modified direct- coupled transistor 
logic (DCTL) NOR gate also referred to less precisely as a resistor- transistor logic 
NOR gate. A total of 60 gates could be interconnected with each other and with a mod- 
ule plug containing 70 pins by a welded nickel- ribbon matrix. Two such assemblies 
fit into each of 36 logic modules, for a total of more than 4300 NOR gates. The com- 
puter would have required fewer integrated- circuit packages if a variety of logic types 
(e. g. , gated flip-flop) had been used. It was estimated, however, that the problem of 
producing and qualifying even a second circuit tjqie would outweigh the advantages of 
using a variety of logic types. In retrospect, this approach is believed to be correct. 
Use of the single logic type simplified packaging, manufacturing, and testing and gave 
higher confidence to the reliability predictions because of the large quantity used. 

One other integrated circuit was used in the Block I AGO, a differential ampli- 
fier for sensing memory outputs. This device was developed especially for the AGC 
and contained the equivalent of six n-p-n bipolar transistors and eight resistors. 

These units were preferred over discrete- component sense amplifiers not only for 
their small size but also for the close match of characteristics and tracking desired 
between components of the differential state. 

As an adjunct to the AGC, a DSKY unit was required as an information interface 
with the crew. The original design was made during the latter stages of the bread- 
board computer development, when neon numeric indicator (Nixie) tubes were used to 
generate three four-digit displays for information and three two-digit displays for iden- 
tification. These six displays were considered to be the minimum necessary for pro- 
viding the capability to display three space vectors with sufficient precision for crew 
operations. The two-digit indicators were used to display numeric codes for verbs, 
nouns, and program numbers. The verb-noun format permitted communication in a 
language having a syntax similar to that of a spoken language. Examples of verbs were 
"display, " "monitor, " "load, " and "proceed"; examples of nouns were "time, " "gimbal 
angles, " "error indications, " and "star number. " A keyboard was incorporated 
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together with the display for entering numbers and codes and for identifying each. In 
the Block I system, two different physical outlines were generated, one for the naviga- 
tion station in the vicinity of the G&N system (lower equipment bay) and one for the 
main control panel located above the crew couches. 

The Block II CM and LM DSKY design evolved to incoxporate electroluminescent 
(EL) segmented numeric displays instead of neon, and a five-digit display instead of 
four to accommodate a base eight (octal) display of a 15- bit computer word. The dis- 
plays are switched by miniature latching and nonlatching relays. Solid-state switching 
circuits, although preferred for this function, were ruled out because of the high vol- 
tage required for EL operation. High-voltage solid-state switching circuits were avail- 
able at the time of the DSKY design, but their reliability had not been proved. 

In 1964, when the Apollo G&N system underwent redesign for both the Block II 
CM and the LM, the final version of the AGC was conceived. This machine was known 
by the various designations AGC, Block II AGC, LGC, and CMC. As stated previously, 
the need was evident for increased memory over that of the Block I AGC, both fixed and 
erasable. There were two major reasons for this need. One was the experience gained 
with mission- related programs for Block I; the other was the identification of new func- 
tions for the Block H system, including the autopilot function. Both memory expansions 
were accommodated with a moderate effect on existing designs. The braid memory, 
a new form of fixed memory with some similarities to the rope but with several poten- 
tial advantages, was under development for possible inclusion in the Block II AGC in 
place of the rope memory. However, because the braid- memory development was not 
sufficiently advanced for the Block H schedule, the rope memory was retained, with an 
increase in capacity from 24 576 to 36 864 words, a factor of 1. 5 greater than Block I, 
made possible by increasing the number of sense lines in each module. The mechani- 
cal design of the rope modules was changed to allow their removal and insertion with- 
out removing the computer from the spacecraft or breaking any connections other than 
those of the rope modules themselves. 

The erasable- memory capacity was doubled to 2048 words, of which the first 8 
were central registers outside the core unit. This increase was made with a small 
increase in driving circuitry, double the number of cores, and an overall volume re- 
duction owing to more efficient space usage and the use of smaller driving transistors. 

In the logical design area, the number of input/output operations in the Block II 
AGC was greater than that in Block I and the overall speed requirement was also great- 
er, both largely as a result of the autopilot requirements. The input/output require- 
ment was met by a number of special circuits for such interfaces as the radar and the 
hand controller and a larger number of standard circuits, such as counter (memory- 
cycle stealing) inputs and discrete inputs and outputs. The speed requirement was met 
by speeding up all circuitry. Indeed, the circuitry was made slightly slower in Block 
n because of a change from high-power micrologic to low-power micrologic. The num- 
ber of instructions was increased from 11 to 34 to include more flexible branching and 
data handling, some double-precision capability, and special input/output instructions. 
Some instructions, including multiply and divide, were made faster through the use of 
extra logic, particularly in the adder circuitry where the time to propagate carriers 
was reduced to approximately one- third its duration in the Block I circuitry. The num- 
ber of gates rose by approximately 1400, from approximately 4300 to approximately 
5700. 
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Improvements in integrated- circuit technology led to the adoption of a new NOR 
gate for Block II. Although still a modified DCTL three- input gate, this circuit dissi- 
pated less than half the power of a Block I gate. Additionally, mounting two of these 
gates on a single silicon chip in a 10- lead "flatpack" container resulted in doubling the 
Block I packaging density. Power usage was reduced in these logic units by increasing 
the output impedance and thereby increasing rise- time sensitivity to stray wiring ca- 
pacitances. Two steps were taken to permit the use of the new device and effect a 
saving in power: multilayer etched boards were adopted as the means of interconnec- 
tion within modules in place of the ribbon matrices to minimize the stray capacitance, 
and the clock timing circuit was improved to accommodate greater uncertainties in 
sign signal- propagation delays. This gate was designed to have a fan-out capability of 
approximately 5 and an average propagation delay of approximately 20 nanoseconds 
while dissipating approximately 5 milliwatts of power. These gates are designed to 
operate over the temperature range of 273 to 343 K (0° to 70° C). 

The importance of using a single circuit should not be underestimated. Thou- 
sands of logic gates are used in each computer. High reliability is essential for every 
gate. This reliability can best be attained by standardization and can only be demon- 
strated by the evaluation of large samples. Had a second type of logic microcircuit 
been used in the AGC, the number of logic elements could have been reduced by approx- 
imately 20 percent, but neither of the two circuits would have accumulated the high 
mean time to failure and high confidence level achieved by the single NOR circuit. 

The Block H AGC design that resulted from the change in technology achieved 
approximately double the speed, between 1. 5 and 2 times the memory capacity, an in- 
crease in input/output capability, and decreases in size and power consumption. The 
Block II DSKY also was redesigned, but the functional characteristics were essentially 
unchanged. The new DSKY design consisted of a smaller mechanical envelope that was 
the same for the three locations, two in the CM and one in the LM. In addition, the 
Block n design of both AGC and DSKY was constrained by new mechanical require- 
ments, such as the environmental seal on all connectors or modules that could be sub- 
jected to and damaged by the high moisture content of the spacecraft. 

The mechanical design evolved from the experience of welded cordwood construc- 
tion and other construction techniques that were applied very successfully to the pack- 
aging of the Polaris guidance system and guidance computer. From this background 
and the changing constraints, the mechanical configuration evolved through a series of 
designs. The major requirements that significantly affected the early configurations 
were the requirements for in-flight repair, for mounting on the spacecraft coldplate 
structure, and for the spacecraft cabling interface. These requirements resulted in 
a configuration having modular construction and removable trays. The housing also 
contained a tray with spare modules. 

Various mechanical and thermal interface problems dictated a change in config- 
uration to what became the Block I (0) computer. The early production computers were 
of this configuration. The mechanical design was not stabilized, however, until the 
requirement for in-flight repair was replaced by the requirement for moisture- 
proofing, which led to a significant change in mechanical configuration using the same 
module designs that were used in Block I (0). Figure 5 is a photograph of the moisture- 
proofed design, which was the final Block I mechanical configuration for the computer 
and the DSKY units. 
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Before the requirement for in-flight 
repair was deleted, a series of mechani- 
cal designs was coupled with studies to de- 
termine the feasibility of fault isolation in 
flight or the feasibility of dual- computer 
operation using manual switchover. The 
Block I (0) AGC (fig. 6) was the only ver- 
sion of this general configuration that was 
built; this configuration was built with room 
for two spare trays to be mounted beside 
the two active trays. This configuration 
shows the result of the various constraints: 
(1) room for spares to accomplish in-flight 
repair, (2) the right-hand tray containing 
cabling to interconnect the computer with 
the rest of the G&N system through the top 
connectors and through the front connector 
to the spacecraft cabling, and (3) the ther- 
mal interface material that was to provide 
heat transfer to the spacecraft coldplate. 
The change to the Block I (100) design was 
accomplished after the requirements for 
spares and thermal interface were elimi- 
nated. 

The increased functional require- 
ments that resulted in the Block II design 
discussed earlier also resulted in a com- 
pletely new mechanical design. The main 
problem of mechanical design in guidance 
computer logic is the creation of signal 
interconnections; indeed, approximately 
three- fourths of the AGC volume is used 
for this purpose. Interconnections are 
primarily of two types: wrapped wire be- 
tween modules and multilayer boards with- 
in modules. 



Figure 5. - Block I (100) Apollo guidance 
computer. 



Figure 6. - Block I (0) Apollo guidance 
computer. 


In the AGC, one of the basic goals 
has been to make the electronic circuits in 
small pieces that are easily installed and removed, for the sake of producibility, test- 
ing, easy diagnosis, and economical maintenance. This goal can only be realized in- 
sofar as it does not excessively degrade the overall packaging density of the computer, 
because volume is, of course, critically limited in the spacecraft. 


The Block II redesign resulted in an end product that was not only smaller and 
lighter than the Block I AGC but that provided better environmental sealing, easy access 
to fixed memory for replacement in the spacecraft, and commonality between the LM 
and CM mounting. Internally, the same type modular construction was used in the 
Block II AGC as in the Block I version. 
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SYSTEM DESCRIPTION 


The Block II computer (figs. 7 and 8) evolved from a series of technological de- 
velopments. Because this design was the only one used for manned operational flights, 
the following description concentrates on the Block n AGC. The computer character- 
istics are listed in table I. 




Figure 7. - Block n Apollo guidance com- 
puter (spacecraft interface side). 


Figure 8. - Block II Apollo guidance com- 
puter (spacecraft cabin side). 


The backbone of the AGC is the set of 16 write buses; these are the means for 
transferring information between the various registers shown in figure 9. The arrow- 
heads to and from the various registers show the possible directions of information 
flow. In figure 9, the data paths are shown as solid lines and the control paths are 
shown as broken lines. 

The AGC is a "common storage" machine; that is, instructions may be executed 
from erasable memory as well as from fixed memory and data (obviously constants, 
in the case of fixed memory) may be stored in either memory. The word sizes of both 
types of memory must be compatible in some sense; the easiest solution was to have 
equal word lengths. 


Electrical 

The AGC has three principal sections as shown in figure 9. The first is a mem- 
ory, the fixed (read only) portion of which has 36 864 words and the erasable portion 
of which has 2048 words. The next section may be called the central section; it in- 
cludes an adder, an instruction decoder (SQ), a memory address register (S), and a 
number of addressable registers having either special features or special use. The 
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third section is the sequence generator, which includes a portion for generating vari- 
ous microprograms and a portion for processing interrupting requests. All logical 
operations in the computer were accomplished using an integrated- circuit NOR gate 
with simple interfaces; the other circuits (i. e., oscillator, power supply, memory 
circuits, alarms, and external interfaces) could not be designed using integrated cir- 
cuits. 


Memory. - The AGC fixed memory is of the transformer type. It is designated 
a "core rope" memory because of the physical resemblance of early models to lengths 
of rope. Incorporated into its wiring structure is an address decoding property, be- 
cause of which its cycle time is not as short as that of some other transformer mem- 
ories having external address decoding. The resulting bit density is extremely high: 

3 3 

approximately 100 bits/cm (1500 bits/in ), including all driving and sensing electron- 
ics, interconnections, and packaging hardware. This high density of storage is 
achieved by "storing" a large number of bits in each magnetic core. A stored bit is 
a "1" when a sense wire threads a core and is a "0" when a sense wire fails to thread 
a core. The total number of bits is the number of cores multiplied by the number of 
sense lines capable of threading the cores. The AGC memory is composed of six 



Figure 9. - Apollo guidance computer block diagram. 
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TABLE I. - COMPUTER CHARACTERISTICS 


Performance characteristic 

Value 


Block I 

Block II 

Word length, bits 

15 plus parity 

15 plus parity 

Number system 

l*s complement 

I's complement 

Fixed- memory registers, words 

24 576 

36 864 

Erasable- memory registers, words 

1024 

2048 

Number of normal instructions 

11 

34 

Number of involuntary instructions 

(interrupt, increment, etc.) 

8 

10 

Number of interrupt options 

5 

10 

Number of counters . 

20 

29 

Number of interface circuits 

143 

227 

Memory- cycle time, jusec 

11.7 

11.7 

Counter increment time. Msec 

11.7 

11.7 

Addition time. Msec 

23.4 

23.4 

Multiplication time. Msec 

117 

46.8 

Double precision addition time. Msec 

^1650 

35.1 

Number of logic gates 

(microcircuits) 

4100 

^5600 

Volume, cm^ (ft^) 

34 300 (1. 21) 

27 400 (0. 97) 

Weight, kg (lb) 

39. 4 (87) 

31. 7 (70) 

Power consumption, W 

100 

70 


^Subroutine. 

I* 

” 2 800 packages. 
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modules. Each module contains 512 cores and 192 sense lines and hence contains 192 x 
512 = 98 304 bits of information. This information is permanently wired; once the mod- 
ule has been manufactured, not a single bit can be changed, either intentionally or 
unintentionally, except by physical destruction or by failure of one or more semicon- 
ductor diodes. 

The erasable memory of the AGC was inherited from its core-transistor logic 
ancestor. It is a conventional coincident- current, ferrite- core array, the ferrite com- 
pound of which yields a combination of high squareness and comparatively low sensi- 
tivity to temperature. Moreover, the silicon transistor circuits that drive this mem- 
ory vary their outputs with temperature to match the requirements of the cores over a 
wide range, from 273 to 343 K (0° to 70° C). Compared to linear (word) selection, 
coincident- current selection affords an economy in selection circuitry at the expense 
of speed. This is advantageous to the AGC, in which the memory cycle time is already 
long, largely because of the fixed memory. The 2048- word array is wired in 32 by 64 
planes with no splices in the wires for highest reliability. 

The erasable memory is a coincident- current ferrite- core system having the 
same cycle time as the fixed memory. Instructions can address registers in either 
memory and can be stored in either memory. The only logical difference between the 
two memories is the inability to change the contents of the fixed part by program steps. 

Central section . - The central section is shown in block form in the middle part 
of figure 9. It contains the address register (S), the memory bank registers mentioned 
previously, a block of addressable registers called "central and special registers" (to 
be discussed subsequently), an arithmetic unit, and an instruction decoder register 
(SQ). The arithmetic unit is an adder with shifting gates and control logic. The SQ 
register bears the same relationship to instructions as the S register bears to memory 
locations; neither S nor SQ is explicitly addressable. The central and special registers 
are A, L, Q, Z, and a set of input and output channels. 

The special and central registers include six addressable and five unaddressabl'e 
flip-flop registers. These include the upper and lower accumulators, memory address 
and bank registers, program counter, adder, memory buffer, and auxiliary registers. 
Only two of these registers (program counter Z and return address auxiliary register 
Q) can be considered nonspecial; that is, having no function other than temporary 15- 
bit storage. The auxiliary register B has an inverted output (denoted C) as well as a 
direct output. The upper and lower accumulators, A and L, perform shifting and over- 
flow storage functions. The memory buffer register G performs shifting and cycling 
functions and controls inhibit digit drivers in the erasable memory. The memory ad- 
dress register S controls memory selection circuits. The bank registers EB and FB 
likewise control memory selection, and both are accessible by way of a common ad- 
dress denoted BB as well as individually. The adder uses two operand registers, X 
and Y, and generates their sum, which is accessed by way of a gate set denoted U. 

Parallel information transfer is effected among these registers by a bus system 
as well as by a certain amount of dedicated transfer circuitry. The read bus and write 
bus have identical information; the former drives the latter through amplifying logic. 
One notable exception, the X register of the adder, is connected to neither bus. This 
register is loaded directly from the upper accumulator A and feeds the adder circuitry. 
Other exceptions are the Y, S, and B registers. 
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other than the flip-flop registers, a number of the erasable registers in the core 
memory are classified as special, owing to special actions connected with their use or 
to their dedication to limited use. The nine registers following the seven central regis- 
ter addresses are dedicated in various ways. The eighth register is vacant and can be 
considered a source of zeros. The 9th to 16th registers are used for temporary stor- 
age of central register contents during program interrupts, and two of these are auto- 
matically read and written by the interrupting and resuming instructions. The 17th to 
20th register addresses are reserved for shifting and cycling, making use of special 
write gate logic built into the memory buffer register G. Finally, the next 28 registers 
(counters) are involved in cycle- steal operations and are either incremented, decre- 
mented, or shifted as the result of input, output, or timing actions of the computer. 

The AGC arithmetic is based on a single adder, which is used for addition, sub- 
traction, multiplication, and division. Information transfer between the AGC and its 
environment occupies a substantial fraction of the computer hardware and time budget. 

Essentially, the Block n AGC has four types of interfaces (neglecting the test 
equipment interface): an input and output circuit that is transformer coupled and an 
input and output circuit that is dc coupled. The nature of information handled through 
the interfaces is varied. In some cases, computer words are transferred directly 
into and out of the computer. Prelaunch and in-flight radio links are maintained be- 
tween the computer and grovmd controllers. Because of the great difference in data 
rates between up and down directions, the mechanizations differ considerably. The 
downlink operates at a relatively high rate (100 AGC words/sec or 1600 bits/sec) and 
is designed to occupy a minimum of the computer time budget. The downlink serializes 
two words stored in parallel in flip-flop registers and, on command, sends the bits in 
a burst to the spacecraft central timing system. The uplink for serial-to-parallel con- 
version is used for whole- word transfers out of the computer to digital spacecraft dis- 
play units. The uplink is also used to accept data from the radar measurement sub- 
system and can be used if desired to communicate between the CM AGC and the LM 
AGC. This interface was called crosslink, and the capability has not been used. 

Incremental information transfer is similar to serial information transfer in 
that a sequence of pulses is transmitted over a single channel. It differs in that each 
incremental transfer pulse represents the same value, or weight, as opposed to serial 
transfer, in which two adjacent pulses differ in weight by a factor of 2, and in which 
the concept of positional notation is used. An incremental receiver counts pulses to 
form a word, whereas a serial receiver shifts pulses to form a word. The Apollo ac- 
celerometers are incremental by nature, producing a pulse output to the computer for 
each unit change in velocity. Incremental transfer is also used for angle commands 
from the computer to the gyros and to the coupling data units, and for thrust control and 
certain display functions in the spacecraft. Pulses are sent in groups or "bursts" at a 
fixed rate. 

Discrete signals are individual or small groups of binary digits that issue com- 
mands or provide feedback for discrete actions, such as switch closures, mission 
phase changes, jet firings, display initiations, and many other similar controlled 
events. The display portion of the computer communicates with the computer proper 
by discrete signals in groups that carry encoded information. All these discrete sig- 
nals have relatively slow reaction-time requirements; therefore, these interfaces use 
the dc interface circuits. 
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The computer is the primary source of timing signals for the spacecraft central 
timing system. Within the G&N system, the AGC furnishes approximately 20 time- 
pulsed signals to various subsystems. 

Sequence generator. - The sequence generator provides the basic memory timing 
and the sequences of control pulses (microprograms) that constitute instructions. The 
sequence generator also contains the priority- interrupt circuitry and a scaling network 
that provides various pulse frequencies used by the computer and by the remainder of 
the navigation system. It is a logic equivalent to wired memory that, for a given time 
pulse of a given memory cycle of a given instruction, stores, shapes, and amplifies 
the appropriate control pulses. 

The instructions are arranged so as to last an integral number of memory cycles. 
In addition to these instructions, there is a number of "involuntary" sequences, not 
under normal program control, that may break into the normal sequence of instruc- 
tions. These are triggered either by external events or by certain overflows within 
the AGC and may be divided into two categories: counter incrementing and program 
interruption. 

Counter incrementing may take place between any two instructions. External re- 
quests for incrementing a counter are stored in a counter-priority circuit. At the end 
of every instruction, a test is made to determine whether any incrementing requests 
exist. If not, the next instruction is executed directly. If a request is present, an 
incrementing memory cycle is executed directly. All outstanding counter increment- 
ing requests are processed before proceeding to the next instruction. This type of in- 
terrupt provides asynchronous incremental or serial entry of information into the work- 
ing erasable memory. 

Program interruption also occurs between program steps. An interruption con- 
sists of storing the contents of the program counter and transferring control to a fixed 
location. Each interrupt option has a different location associated with it. Interrupt- 
ing programs may not be interrupted, but interrupt requests are not lost and are proc- 
essed as soon as the earlier interrupted program is resumed. 

The clock section of the AGC consists of a ring counter, a scaler, a time-pulse 
generator, and circuits to generate subphases of the time pulses using the 2. 048- 
megapulse oscillator as the primary source of timing pulses. The spacecraft refer- 
ence signal of 1. 024 megapulses/sec is obtained by dividing the 2. 048- megapulse oscU- 
lator output in a single-stage scaler. This reference signal is also used together with 
the oscillator output to generate four phases of the 1. 024- megapulse signal for use in 
sequencing activity within time pulses. A divide- by- 12 circuit generates the 12 sepa- 
rate pulses of 0. 977- microsecond duration that occur sequentially within a memory- 
cycle time of 11. 7 microseconds. 


Power Distribution 

Power distribution is a special problem in the AGC. The current drawn by the 
gates is approximately 6 amperes at 4 volts dc. For the sake of efficiency, these cur- 
rents must be distributed from the power supply to the logic modules with very little 
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dc-voltage drop. Moreover, the current return, or zero-volt distribution, must not 
sustain any ac voltages of a frequency or amplitude sufficient to activate or deactivate 
a gate inadvertently. This controlled power distribution is accomplished by building 
an interlaced gridwork of heavy conductors on the terminal posts of the tray. Each 
group of 60 gates shares, in a module, a ground plane that is brought out at three 
equally spaced places to connect to this gridwork, which provides multiple paths for 
return current in much the same manner as a ground plane. The other power source, 
the positive voltage, is distributed by a gridwork circuit to two points on the power bus 
shared in a module by each 60- gate group. 


Mechanical 

The mechanical carrier into which all modules are inserted is called a "tray. " 
The AGC consists of two trays: one for logic, power supply, and interface modules 
and the other for memory and ancillary circuit modules. The 15 000 jacks on the tray 
into which signal pins are inserted pass through the tray and extend out the other side 
in the form of posts having square cross sections. Interconnections between pins are 
made by wires the ends of which are tightly wrapped around the posts without the use 
of any further contact mechanism such as solder or welds. This method has several 
advantages: it is executed by a machine, which requires only a few seconds per wire; 
it is controlled by a punched- card input; it can easily be altered if a change is desired; 
wires can be run point to point if desired; and the reliability of the connection is ex- 
tremely high because there is no signal point at which bending stress is applied. More- 
over, this interconnection method is compatible with hand wiring, which is required 
wherever wires are twisted together to protect low-level signals or where heavy- gage 
wire is needed for accommodating high currents. 

The main tray structure of the AGC is a magnesium frame into which the modules 
are affixed by jacking screws, providing a good thermal path between modules and tray. 
The tray in turn is screwed to a coldplate, where heat is removed. The frame also 
provides moisture seals for all internal wiring and connectors. 


Display and Keyboard 

The display and keyboard unit (fig. 10) is in some respects like an integral com- 
puter part, yet it is operated using the same interface circuits used for connection to 
other subsystems and systems. Because the DSKY serves as the channel for human 
communication with the computer, it needs a rather high peak-data rate without being 
very large or having too many wires between the DSKY and the computer, located a few 
feet distant along a cable. 


The principal part of the display is the set of three light registers, each contain- 
ing five decimal digits composed of electroluminescent segmented numerical lights. 
Five digits are used so that an AGC word of 15 bits can be displayed in one light regis- 
ter by five octal digits. In addition, there are three two-digit numerical codes for the 
verb, noun, and major program. In addition to the numerical lights, a computer activ- 
ity segment and a sign position are included in each light register. Electroluminescent 


30 


lights are small and easy to read and re- 
quire relatively little power. The EL 
lights are driven by an 800- hertz, 250- 
volt ac power supply, switched by minia- 
ture latching relays. Both latching and 
nonlatching relays are used for external 
interfaces with other subsystems and sys- 
tems and are located in the DSKY, where 
they share driving circuits with the light- 
register relays. A double-ended selection 
matrix, organized so that one of 14 groups 
of 11 relays is set at a time, is used for 
actuating the relays; 11 signals are re- 
quired from the computer to govern the 
configuration of the 11 relays in a group, 
and 4 more bits are used to select one 
group out of 14, making 15 bits. The fact 
that this is the size of the AGC word is not 
entirely coincidental. This arrangement 
allows one word in the DSKY output chan- 
nel to control enough relays to light two 
numbers in a light register and one stroke 
of a sign. 

The keyboard has 19 keys, which are used to enable concise yet flexible commu- 
nication between man and computer. Commands and requests are made in the form of 
sentences each having an object and an action, such as "display velocity" or "load de- 
sired angle. " The first is typical of a command from man to machine; the second is 
typical of a request from machine to man. The DSKY is designed to transmit such 
simple commands and requests made up of a limited vocabulary of "verbs" and "nouns. " 
Because these verbs and nouns are displayed by number rather than by written word, 
it is necessary to either learn them or have a reference document at hand. 

The interface between the computer and DSKY uses the standard dc interfaces. 

The key depressions are coded in the DSKY into a 5- bit word as inputs to input channel 
15, bits 1 to 5, of the computer; and the computer outputs are derived from output chan- 
nel 10, bits 1 to 15, with additional bits for nonlatching relay drivers in channel 11. 

The output from channel 10 is decoded in the DSKY by way of a matrix to drive the vari- 
ous light segments. 

The principal parts of the DSKY are the frame, six indicator-driver modules, 
the 800- hertz power supply, two pluggable display panels, and a keyboard. The power 
supply provides high-voltage ac power for lighting the EL display panel. The panel 
lighting is controlled by way of the latching relay, which provides coding and storage 
for the commanded display data. The status and caution panel is lighted with filamen- 
tary bulbs also switched by means of either latching or nonlatching relays. In the case 
of nonlatching relays, the information is stored in the AGC output register driving a 
detailed display light. The keyboard is a special design to permit lighted keys, the 



Figure 10. - Display and keyboard. 
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required actuating force, and small size. All these elements are interconnected and 
environmentally sealed by the frame and covers. The mechanical design of the DSKY 
is such that either the EL display panel or the status and caution panel can be removed 
and replaced without removing the DSKY from the spacecraft or breaking any connec- 
tions other than those of the panels removed. 


Software Requirements 

The development of the computer software started early in the program and pro- 
gressed in parallel with the hardware development. Software capable of testing the 
hardware was the first requirement; and, to accomplish this end, many of the utility 
programs were required also. The test software initially released was in a very prelim- 
inary state but was capable of accomplishing the functional test of the hardware. Ex- 
panded programs with capability for operation of a system followed as techniques for 
software preparation and rope manufacturing were developed. The flight software is 
not discussed in the PGNCS report. 


DEVELOPMENT PROBLEMS 


Computer development problems in the areas of excessive delay times, noise sus- 
ceptibility, presence of diode sneak paths, flatpack corrosion, diode channeling effect, 
relay contamination, transistor bonds, flatpack lifted bonds, and diode switching char- 
acteristics are discussed in the following paragraphs. 


Timing 

The logic section of the computer consists of 24 modules containing 120 dual flat- 
packs. The original concept was to interconnect these gates with several layers of mat- 
rices stamped out of nickel ribbon. During testing of the prototype computer, it was 
determined that the capacitance between these layers prevented the computer from op- 
erating properly because of long delay times. Before this, the use of multilayer boards 
was being investigated as the interconnect but, because of the state of the art, they had 
not been selected. After looking at all the alternates to correct this timing problem, it 
was determined that the multilayer board would best accomplish this end. A program 
was implemented to use the multilayer board in all production computers. 


Noise 

Originally, the computer was highly susceptible to noise. This problem was cor- 
rected as follows: (1) by tying the power ground to the chassis ground inside the com- 
puter and (2) by installing a module on the test connector that loads the test-point out- 
puts when the test connector was not being used. This procedure prevented noise feed- 
back into the computer circuits. 
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Sneak Paths (Blue Nose Gates) 


Originally, the logic section of the computer used only one component, a dual 
three- input NOR gate per package using a common B+ connection, to perform all func- 
tions. As a result of the inherent design of the dual flatpack integrated circuit, diode 
sneak paths exist between the two circuits within the same package. The problem oc- 
curred when the outputs of two or more circuits were tied together to increase the fan- 
in capability. When the B+ connection was not made to the circuit (blue nose gate), as 
is the case when the circuit is used as a fan-in interface, the diodes became forward 
biased and caused cross coupling between the two circuits within the same package. 

A change of flatpack components for those circuits being used as blue nose gates 
was required. This approach involved the development of a modified dual- integrated 
circuit in which the collector resistors are not connected to the collector. However, 
because the resistors and extraneous diodes would still exist within the package, it was 
necessary to connect the B+ lead to back bias the diodes. 


Flatpack Corrosion 

Early in the program, a time- dependent failure mode caused by corrosion of the 
chip element was detected. During the subsequent failure analysis and investigation, 
it was determined that the corrosion was caused by leakers not detected during the 
gross leak tests. Because the hermetic integrity of integrated circuits is essential for 
maximum reliability and because the assurance of this integrity is dependent on the ef- 
fectiveness of the leak tests, it was incumbent on the G&N contractor to develop an ef- 
fective yet nondestructive screening test. After investigations of various methods of 
detecting leakers, the following gross leak test was found to be the most effective and 
reliable method for detecting the leakers. The test is accomplished by weighing each 
device and recording the weight, immersing in a Freon solution under pressure, and 
reweighing the device. A device that gains more than 0. 00050 gram (0. 0000175 ounce) 
during this procedure is a leak reject. This method of conditioning of flatpacks affords 
the following advantages. 

1. Corrosive liquids are eliminated. 

2. Very few good devices are rejected; therefore, a higher yield in production 
is realized. 

3. The criterion for failure is a change in specimen weight, and a decision by 
the test observer is not necessary. 

4. Specimen weights are recorded and can be easily rechecked. 

5. Although backfillii^ fluid can become trapped within a specimen, leak detec- 
tion can still be accomplished. 
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6, The method contains a weighing fail-safe feature by requiring unit rejection 
on either Increasing or decreasing weight indications. 

7. The method allows storage of specimens in Freon for as long as 4 hours be- 
fore the final weighing. 

The military specification controlling the leak test methods has been changed to include 
this procedure as an acceptable method. 


Diode Channeling 

During the design of the computer, the number of different types of the same com- 
ponent was held to a minimum. A diode of "mesa" construction was originally used ex- 
tensively throughout the computer subsystem. During qualification testing, it was de- 
termined that this diode was not suitable in all applications because of channeling and 
surface instabilities that resulted in unacceptably high leakage currents. Replacement 
of this component with a diode having planar construction decreased the channeling 
effect. 


Relay Contamination 

The early computer subsystems (e. g. , DSKY) were continually plagued with an 
inherent relay contamination problem. Although the relay vendors implemented exten- 
sive cleaning, handling, processing, and tooling changes to lessen contaminants, parti- 
cles were still present in the relays. Along with the suppliers' improvements, addi- 
tional efforts to separate acceptable relays produced a relay vibration screening test. 
This test was designed to eliminate contaminated relays through the detection of contact 
short and open circuits during relay operation. Resultant data analysis indicated that 
these vibration tests provided an overall effective screen but were not cost-effective. 


Transistor Bonds 

The main transistor trouble areas were bonds and leads. For the gold (Au) and 
aluminum (Al) system, "purple plague" was a problem for those manufacturers having 
difficulty controlling their bonding pressures and temperatures. Bonds made with an 
all- aluminum system contributed a rash of other problems. Making a strong bond was 
one problem, shorting to the chip edge was another, and the most dramatic of all was 
the moving (fatigued) aluminum wire. The bond- strength and chip- shorting problems 
diminished as transistor manufacturers gained experience. The moving lead and fa- 
tigue problem was associated primarily with wedge bonds and 25. 4- micrometer (1 mil) 
diameter aluminum wire. The cooling and heating of the wire during computer opera- 
tion caused the lead to move (wiggle); consequently, the lead would break because of 
fatigue. The problem was minimized or eliminated when the material of the wire was 
changed to gold, when the diameter of the wire was increased to 38. 1 micrometers 
(1.5 mils), or when a different bonding (ultrasonic) technique was used. A mixture of 
these corrections was implemented by various manufacturers. 
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Flatpack Lifted (Gold Rich) Bonds 


Early in the Block n AGC history, the flatpacks exhibited bond failures that had 
not previously been observed in the Apollo integrated circuit. Through failure analysis, 
it was determined that the failed (lifted) bonds had separated through an intermetallic 
region of the ball. 

At temperatures above 473 K (200° C), it is known that intermetallic formation 
occurs at a significant rate. Also, failure of the bond usually occurred from mechani- 
cal fracture through the brittle AugAlg intermetallic layer. This excessive intermetal- 
lic formation most probably resulted from exposure to the lead bonding temperature 
(593 K (320° C)) for an extended period. It has been concluded that the random fail- 
ures throughout the AGC program were the result of random and relatively remote 
workmanship (operator) errors, in that the operator left the devices on the heated bond- 
ing stage for several minutes. Normal bonding time is less than 1 minute. Although 
the vendor was made aware of and attempted to minimize this failure mode, occasional 
failures still occurred in the AGC. 

The larger share of these AGC failures have been detected at system turn-on; as a 
probable explanation, studies have determined that potentials as low as 2 volts could ’’heal” 
bond failures by electrostatic attraction. The overall failure rate (0.2765 failure per 
10 million operating hours through 1972) of the part remains low because of the large num- 
ber of components used in the system compared to the small number of system failures. 


Diode Switching Characteristics 

The problem of diode switching characteristics was detected in several fixed- 
memory modules (ropes) having flight programs, when operating in computers. All 
these ropes had passed the tests required by the procurement specifications and had 
been accepted by the Government. The results of an investigation are summarized as 
follows. The failure caused the computer to read out an erroneous word from the rope 
memory. The failure was intermittent and dependent on the rate at which the computer 
addressed the defective area. The cause of this failure was eventually proven to be 
one diode of a matched pair of fast- switching diodes that was slow to activate when op- 
erating in the memory circuits. In the circuit application, the very slow turn-on time 
(>1. 0 microsecond) of the defective diode in the matched pair was causing transients 
that resulted in erroneous outputs; as a component, however, the slow diode of the 
matched pair was only on the order of 0. 1 microsecond slower turning on than was the 
mate. It was determined that, if one diode activates much faster than the other, the 
diode that turns on quickly will clamp the voltage across the slow diode to a value 
roughly equal to the dc forward- voltage drop and thereby cause it to switch much more 
slowly and offset the output. This proved to be an applications problem, not a compo- 
nent problem. This problem was corrected for the application by matching the diodes 
under both dynamic and static conditions. 
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OPTICAL SUBSYSTEM 


In this section, the design criteria, development, hardware changes, major test 
programs, and equipment performance of the Apollo optical subsystem are presented. 
The Apollo optical subsystem is divided into two major parts — CM and LM systems — 
the design considerations for which included experience gained from Project Mercury, 
the Gemini Program, and unmanned programs. The Apollo CM optical subsystem con- 
sists of a scanning telescope (SCT) and a sextant (SXT) mounted in a single beryllium 
block. The SCT is used for gross star acquisition and the SXT for accurate navigation 
and alinement sightings. 

The LM optical subsystem is a single-power AOT developed from a basic con- 
cept of providing the capability for star sightings from the lunar surface for inertial 
alinement purposes. 

The successful performance of both optical instruments during 10 manned Apollo 
missions is indicative of the quality of this equipment. 

DESCRIPTION 


The CM optical unit assembly (OUA) consists of two optical instruments (SXT and 
SCT) mounted within a common base (fig. 11). The SCT is a single- line- of- sight (LOS), 
refracting- t 3 q)e, low-power instrument with an instantaneous field of view of approxi- 
mately 60°. The SCT wide field of view is used for general celestial observations and 
recognition of target bodies. The instrument is also used for initial coarse orienta- 
tion of the IMU. An additional use is for landmark tracking during Earth and lunar 
orbits. 

The SXT is an extremely accurate, dual- LOS, electro- optical instrument having 
28- power magnification and a 1. 8° field of view. This instrument is capable of sight- 
ing two celestial targets simultaneously and measuring the subtended angle between 
these bodies to an accuracy of 10" of arc. The SXT is used for IMU- orientation pur- 
poses by celestial body sightings. Celes- 
tial navigation is accomplished by star- 
horizon or star- landmark measurements. 

The SXT also contains the capability for 
landmark tracking during Earth or lunar 
orbits. 

The AOT (fig. 12) is a periscopic- 
type telescope having an external field of 
view of approximately 60°. Optical sight- 
ings on lunar surface objects or celestial 
bodies are accomplished by manual rota- 
tion of the AOT to one of six available de- 
tent positions. The AOT sighting informa- 
tion is used to orient the IMU in lunar Figure 11.- Command module optical 

orbit or on the lunar surface. unit assembly. 
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The PGNCS development contractor 
was responsible for the design concept of 
both Apollo optical instruments. The de- 
tailed design was approved by the NASA 
L5mdon B. Johnson Space Center (JSC) 
(foi'inerly the Manned Spacecraft Center 
(MSC)) and provided to the optics subcon- 
tractor. The optics subcontractor provid- 
ed resident personnel at the development 
contractor's facility during the initial de- 
sign phase to assist with the design details. 
The development contractor provided the 
optics contractor and subcontractor with 
technical direction during the design and 
development phases. 

DESIGN AND DEVELOPMENT 

The OUA and AOT evolved from a 
combined effort of the development contrac- 
tor and the optical subcontractor. The de- 
sign concept was the prime responsibility 
of the development contractor with subcon- 
tractor personnel in residence to assist 
with the formulation of the concept. The 
subcontractor was responsible for initi- 
ating detailed layout, assembly, and speci- 
fication control drawings. 

Throughout the design concept and 
drawing generation phases, extensive ef- 
fort was expended in choosing materials 
that would withstand space environmental 
requirem.ents. The equipment design and 
development phase required approximately 
3. 5 years to complete. 



Figure 12. - Lunar module alinement 
optical telescope. 


The three basic configurations during the course of the OUA development were 
Block I (0), Block I (100), and Block II. The following is a brief outline of each system 
configuration. 

1. Block I (0) - Initial design concepts fabricated into working hardware 

2. Block I (100) 

a. Addition of an antibacklash gear for increased accuracy 

b. Application of high- efficiency optical coating to improve light transmissi- 

bility 
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c. Implementation of large-diameter optical base to ensure an overall error 
of less than 10 arc- seconds 

d. Addition of tracker/photometer electronics to provide astronauts with an 
automatic star- tracking capability and with assistance in horizon seeking 

3. Block II 

a. Incorporation of Block I (100) changes except for the tracker/photometer 
capability^ 

b. Incorporation of new motor- tachometers to provide additional power for 
increased mechanical load 

c. Inclusion of quick-disconnect eyepieces having electrical heaters to pro- 
vide antifogging and quick-change capabilities 

The design philosophy of the AOT emphasized simplicity and reliability. No ma- 
jor configuration changes were required. Minor modifications were made late in the 
program to accommodate operational interface changes and to minimize visibility prob- 
lems such as solar light impingement, stray light reflections, and structural obstruc- 
tions to vision. 


Major Test Programs 

The major test programs performed during the design, development, and manu- 
facturing of the OUA and the AOT can be categorized as design verification, qualifica- 
tion, acceptance level testing, and field testing. 

Design verification . - The design verification tests consisted of mechanical integ- 
rity and thermal- vacuum tests. Because the OUA and the AOT were designed to be 
exposed to cabin and space environments at the same time, special facilities were re- 
quired to test these units. A dual- compartment chamber simulating both internal 
spacecraft and external space environments was used. Portholes with windows were 
required to have an accuracy of 10 arc- seconds for the OUA. Testing of the AOT was 
performed at the development contractor's facility, whereas OUA testing was accom- 
plished at the optics subcontractor facility. Test programs at both facilities were per- 
formed on the AOT and on the Block I and Block II optical unit assemblies in the fol- 
lowing manner. 

1. If any abnormal condition occurred, the test was terminated and the results 
were reviewed by representatives of the development contractor, NASA, and the sub- 
contractor to determine the cause of the problem (i. e. , design test procedures and/or 
test equipment). 


^The tracker/photometer electronics proved impossible to make operational with- 
in the allotted timespan; hence, this capability was deleted from the Block II configu- 
ration. 
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2. E a design change were required, the instrument was modified and retested 
to the environment at which the failure occurred. 

3. Upon successful completion of the retest, the test program was continued. 

An additional OUA mechanical integrity unit was tested to destruction, which occurred 
at approximately 600 percent of the qualification of vibration levels. 

Qualification program. - Qualification tests were performed at the part, subas- 
sembly, and subsystem levels. Only critical parts, such as motors and resolvers, 
and subassemblies were tested. The subcontractor performed full-scale qualification 
test programs on both the AOT and the OUA in accordance with the Apollo Airborne 
Guidance and Navigation Qualification Specifications. The same test facilities used 
during the design verification tests were used for the qualification program. The de- 
sign verification program was excellent and precluded any major qualification failures 
except for the OUA motor-tachometers. Failure analysis indicated insufficient bear- 
ing lubrication and contamination as the causes of this failure. These deficiencies were 
corrected and the OUA was retested with no problems. Design changes incorporated 
to facilitate operational requirements required delta- qualification programs to ensure 
hardware integrity. Additional testing was performed on the spacecraft level to sup- 
port mission requirements. No major failures occurred in flight, thus indicating the 
adequacy of the qualification test program. 

Acceptance level testing. - Operational thermal- vacuum and random vibration 
acceptance tests were run on each production unit and each unit after major repairs. 

The significant thing that was found to be unique to optical systems was that, after ini- 
tial assembly, an optical alinement shift occurred during the first exposure to vibra- 
tion. This shift stabilized after one vibration exposure. The acceptance test was thus 
preceded by a pretest vibration and alinement to ensure that no shift would occur upon 
acceptance vibration. 

Field testing. - Computer analysis and engineering studies indicated a severe 
visibility problem with the OUA and AOT because of sunlight reflection from the space- 
craft structure. To understand these problems and to determine whether design 
changes could be implemented, a field test program was developed using flight- 
equivalent hardware and full-scale models of the respective spacecraft involved. This 
program became known as Project MOSES, referring to the Mobile Optical System 
Evaluation Simulator that is shown in figure 13. 

All field tests had a common goal of evaluating the visual performance and capa- 
bility of the CM and LM optical subsystems. Previous Gemini Program and Project 
Mercury experience had demonstrated the difficulty in seeing stars under daylight con- 
ditions in space. To achieve the best test conditions with minimal atmospheric disturb- 
ance and contamination, these tests were performed at the following field sites: 
McDonald Observatory, Kitt Peak National Observatory, Climax Solar Observatory, 
and U. S. Army Fort Huachuca. 

As a result of the field tests, the AOT was provided with a sunshade to preclude 
visibility problems during its operation. There were no practical means of providing 
a design change to prevent all types of visibility problems from occurring with the OUA 
during CM/LM docked configurations because of the proximity of the CM in the AOT 
field of view during simlight. However, the tests did verify the results of previous 
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Figure 13. - Mobile Optical System Evaluation Simulator. 


Major Hardware Changes 

Major hardware changes required in the development of the optical subsystem are 
described in the following paragr^hs. 

Eyepiece development. - The OUA eyepieces required several major configuration 
changes because of complex interfaces with the space •suits and because of operational 
difficulties. These changes included quick- disconnect features, focusable capabilities, 
and the development of long eye relief for suit operations. Humidity in the CM caused 
eyepiece fogging and necessitated electrical heaters to keep the temperature of the eye- 
pieces above the dewpoint level. Operational difficulties within a limited amount of 
space created the necessity to design a storage compartment for the eyepieces in an 
area near the OUA, The OUA eyepieces are turret mounted by means of a detent mech- 
anism for quick installation or removal. 
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The original eyepiece incorporated a heater and a foam rubber blanket insulator 
configuration. The 1967 fire hazard investigation resulted in the replacement of the foam 
rubber blankets with metallic guards. An additional problem with eyepiece fogging oc- 
curred during the Apollo 15 flight in July 1971. The SCT eyepiece visibility was impaired 
by moisture formation on the optical elements. Subsequent investigation revealed that 
no visual sightings through the SCT or SXT were performed during the initial humidity 
test cycle. An engineering evaluation of visual sightings during humidity environment 
exposure was performed during the latter part of 1971. The results of this evaluation 
proved that the SXT heater arrangement was adequate but revealed the SCT needed a 
larger and more strategically located heater. A program to incorporate this SCT heat- 
er change in all Apollo flight units was accomplished before the Apollo 16 flight. The 
satisfactory results of the Apollo 16 optical sightings proved the value of this late design 
change. 

The AOT sunshade. - Tests performed by NASA on the amount of stray light re- 
flected by the LM spacecraft skin, rendezvous radar, and so forth revealed that such 
reflections would "wash out" any star sighting attempted through the AOT. A sunshade 
was designed to reduce the reflected light to a level that would permit AOT star sight- 
ings. Maximum allowable weight of the sunshade was not to exceed 284 grams (10 
ounces). 

Design go-ahead was authorized November 21, 1967, and the final design con- 
sisted of a truncated cone containing internal baffles and two mounting clamps. The 
entire assembly was machined from aluminum; the internal baffles were black anodized, 
and the cone exterior was painted white. The entire assembly was mounted to the in- 
ner tube of the AOT and rotated with the AOT. Testing performed by NASA with the 
sunshade, using a LM mockup, showed a drastic reduction in the amount of reflected 
stray light. Satisfactory performance was demonstrated during the Apollo 11 mission. 

A side effect from the introduction of the sunshade was the immediate availability 
of three more detent positions for star sightings. Through a mathematical technique, 
these three "rear" detent positions were calibrated from alinement data obtained on the 
three existing detents (i. e. , the front, right, and left detents). Use of the rear detents 
during Apollo 11 lunar surface alinements proved their acceptability. 

The QUA refurbishment. - Two major problems that appeared during the Apollo 
Program were evaluated and considered limited- life constraints to the OUA. The prob- 
lems were beryllium corrosion and silicone lubricant migration from motor- tachometer 
bearings. A major refurbishment program, implemented in late 1969, made provisions 
for passivation of the beryllium cavity and development of a longer life motor- tachometer 
lubricant. These changes increased the estimated operational lifetime of the OUA from 
3 years to 10 years. Previous attempts to correct these problems had been imsuccess- 
ful. 


Apollo tracker/photometer. - The star tracker and the photometer were initially 
designed and developed as part of the Apollo G&N system to be implemented in Block 
II production. 

The star tracker was an electro- optical device used to maintain closed-loop 
tracking after manual acquisition of a navigation star. Measurement of the angle 
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between the landmark and the star in the Block I OUA SXT required the astronaut to 
manipulate the optics hand controller and the CM rotation hand controller simultane- 
ously to obtain coincidence. When the tracker was added to the SXT star LOS, the as- 
tronaut needed only to maintain landmark lock- on; the tracker would maintain star lock- 
on and coincidence of both images. 

The photometer was introduced along with the landmark LOS feature to relieve 
the astronaut of the responsibility of determining when the optics instruments were 
aimed at the actual edge of the Earth disk. The photometer is an electro- optical de- 
vice used to determine the Earth horizon by locating and marking the half-power point 
as the SXT scanned the Earth disk. The Earth edge, which under visual observation 
is distorted by atmospheric and sunlight variations, could then be used as a naviga- 
tional reference. 

The Block II design concept incorporated the new optics and electro- optical ele- 
ments in the OUA SXT head; the downstream signal processing electronics, in the PSA. 
The OUA redesign was completed in time for implementation in the Block I (100) con- 
figuration in the spring of 1965. However, development problems with system integra- 
tion electronics led to program difficulties. Rather than allow the problems to affect 
overall Apollo schedules, NASA in December 1965 decided to forego the conveniences 
of the new tracker/photometer features and to delete the unit from Block II equipment. 
This decision was predicated on the following reasons. 

1. The software was to include the capability for automatic positioning of the op- 
tics, This capability would alleviate control problems and reduce the need for a track- 
er that was only semiautomatic; that is, the star tracker required manual positioning 
of the OUA to the star before lock- on. 

2. The entry corridor angle was decreased, and studies indicated that visual 
observation of the horizon was adequate; thus, the need for a photometer was elimi- 
nated. 


3. The Manned Space Flight Network became the primary mode of updating the 
vehicle state vectors. The OUA was secondary for navigation. 

Apollo rangefinder. - The Apollo 7 flightcrew pointed out the need for a range- 
finder to aid in the rendezvous operation as a substitute for very-high-frequency rang- 
ing, which was not available until the Apollo 10 mission. The MSC generated the speci- 
fication for an optical ranging device using the KS-205 diastimeter (a space sextant de- 
veloped by the NASA Ames Research Center) principle. In November 1968, the optics 
contractor undertook a program to design, fabricate, qualify, and deliver flight hard- 
ware and to train the astronauts in the use of the Apollo rangefinder in time for the 
February 28, 1969, Apollo 9 launch. 

To convert the KS-205 diastimeter for use as an Apollo rangefinder, it was nec- 
essary to rescale the basic parameters to a particular LM target size and to associate 
it integrally with a telescope sight to provide a compact, lightweight, handheld or 
bracket- mounted system with convenient range readout. 
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The flightcrew of Apollo 9 reported that the rangefinder was used with good re- 
sults during the docking maneuvers with the LM. The crewmen also used the range- 
finder as an 8- power telescope to view a Pegasus satellite that passed in close orbit. 

At the mission debriefing, the flightcrew stated that the performance of the instriunent 
was adequate. 

Astrosextant passive thermal protection system development. - In May 1966, the 
Apollo Program Manager made a decision that resulted in removal of the OUA space- 
craft doors. This decision was made to eliminate the in-flight safety problem of a pos- 
sible catastrophic failure of the CM OUA protective doors during flight; such a failure 
would completely block the OUA line of sight and render the instrument useless. 

It was decided that a passive ablative thermal protection system would be used 
to enclose the OUA. The MSC was given the responsibility for developing the design 
requirement, and the CM prime contractor was to manufacture the necessary hard- 
ware. The astrosextant passive thermal protection system consisted of covers and 
crowns attached to the SXT and the SCT to provide thermal protection of the CM struc- 
ture. Ejectable dust covers were provided to prevent contamination during launch and 
orbit insertion. Special qualification tests were performed to ensure the thermal in- 
tegrity of the hardware under simulated entry conditions. The installation of this sys- 
tem reduced the instantaneous field of view of the OUA from 60° to approximately 45° . 


FLIGHT HARDWARE PERFORMANCE 


The OUA and the AOT underwent a series of preinstallation, installation, and 
postinstallation checks at both subassembly and system levels. These checks were 
performed at facilities of the prime G&N contractor, the LM contractor, the NASA 
John F. Kennedy Space Center, and the CM contractor. Preflight testing included but 
was not limited to OUA and AOT functional accuracy tests at the subsystem level, LM 
IMU functional accuracy tests at the spacecraft level, CM spacecraft systems tests 
and spacecraft integrated tests, and CM IMU functional accuracy checks at the launch 
site. 


All OUA and AOT units successfully passed all preflight requirements and no 
major failures were encountered. Of major importance was the confirmation that all 
ground- support test equipment, expressly designed and fabricated for preflight testing, 
proved adequate for its task. As a consequence of the failure-free performance of the 
OUA and the AOT in preflight testing, no unresolved anomalies of the flight equipment 
existed before any of the Apollo missions. 


In-flight Problems 

The in-flight performance of the optical subsystem was excellent. Only a few 
"human factor" type hardware problems were observed throughout the Apollo Program. 
These problems, which were corrected with a minimum of effort, are summarized in 
the following paragraphs. 
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Sextant reticle . - The refraction of the glass-air interface in ground tests changes 
slightly in space where glass- vacuum is encountered. Thus, two reticles were re- 
quired, one for ground tests in the glass- air focal plane and one for space in the glass- 
vacuum focal plane. The dual- reticle pattern was singled out as a possible source of 
measurement error. Proper training of flightcrew personnel to recognize which reti- 
cle was which resolved this problem. 

Reticle halos.- The extraneous light in the form of peripheral glow or "halo" re- 
sulting from the lighting arrangement used to illuminate the reticle was distracting and 
caused some offcenter stars to be washed out. This problem was corrected by adding 
a field stop in the eyepiece. 

Eyepiece mounting. - The panel mount for the eyepieces, although affoi^ing a 
quick- disconnect capability, was not sturdy enough to prevent wobble. This problem 
was corrected by the addition of a shim on the OUA faceplate. 

Solar impingement and stray light reflections. - Limited SCT and SXT use while 
the CM and the LM were joined suggested the need for a Sun shield or for other correc- 
tive measures. The final correction for this problem was procedural and resulted in 
reorientation of the spacecraft stack before performance of optical sightings. 

Eyepiece fogging. - The CM cabin relative humidity during late Apollo missions 
was very high and resulted in SCT eyepiece fogging despite the previously added heater. 
Use of a larger and more strategically located heater corrected this problem. 

Foreign particles in APT. - Crewmen of one Apollo mission reported foreign 
particles on the AOT index head. This particular problem was traced to AOT instal- 
lation procedures and was subsequently corrected by covering all openings during in- 
stallation processes that generated particles. 


Flight Failures 

Two problems, both in the OUA, were considered actual hardware flight failures. 

Counter failure. - During the Apollo 9 mission, a counter failed because a pin 
lodged in the OUA gear- train mechanism. In this mechanism, a geneva gear pin in an 
interference fit application was found to have been used when dimension variance 
allowed a no- interference in a number of instances. Although this failure did not render 
the optical subsystem inoperable, because the free pin lodged between a split gear 
mechanism, all pin applications were checked and replaced if they were found to have 
an inadequate interference. 

Internal harness connector . - During the Apollo 16 flight, an erratic or jerky SCT 
reticle motion was observed. Postflight analysis indicated a female socket spring con- 
tact of an internal OUA harness connector was broken and thus provided an intermittent 
connection. Further analysis indicated the breakage was caused by a fracture during 
assembly which slowly had propagated during the years of storage by stress corrosion 
due to exposure of the unsealed connector. All similar connectors in Apollo- Skylab 
vehicles were replaced before the Apollo 17 mission. 
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INERTIAL REFERENCE INTEGRATING GYRO 


The history of the Apollo inertial reference integrating gyro is discussed in terms 
of its initial selection, procurement history, design description, failure history, and 
problems. The Apollo IRIG design is based on the reasonably successful Polaris Mark 
n model 25 IRIG. Unfortunately, no data were available on Polaris instruments rela- 
tive to bearing life. As a result of bearing and contamination problems, four vendors 
supplied IRIG units during the Apollo Program. 

The two major problem areas were contamination of the float cavity and wheel- 
bearing failures. Contamination was primarily a low-yield (high rejection rate) problem 
involving state-of-the-art cleaning procedures and practices. Wheel- bearing failures 
resulted in several actions that were taken over a period of years to increase the life 
and improve manufacturing yields. 

Selection of MIT as the prime G&N contractor made the selection of an MIT- 
designed gyro probable. Because early mission- error analyses indicated performance 
compatibility, the MIT system proposal was based on the use of the Polaris system; 
and, because the Polaris procurement had been reasonably successful, the Polaris 
Mark II model 25 IRIG was selected as the Apollo gyro. 

Certain changes were made in adapting the Polaris instrument for the Apollo 
application. The torque generator was changed from a two- winding, current-product 
torquer to a single- winding, current- squared torquer to provide a more efficient com- 
puter torquing interface. Torque generator and signal generator excitation frequen- 
cies were changed from 4800 and 800 hertz, respectively, to 3200 hertz to match the 
computer timing-pulse frequency. 

Of all the manufacturing and technological problems that were encountered in the 
8- year span of the development and manufacture of the Apollo PGNCS, the IRIG ball 
bearing problem was the most persistent and was the last to yield to solutions. To 
understand the origin of the problem, a review of the early decisions in the Apollo 
Program is necessary. The inertial instruments, of course, are the heart of any in- 
ertial system design. In early Apollo G&N concepts, the Polaris missile IRIG was 
considered to have adequate performance to be the base design for the Apollo system. 
Thus, with minor changes (all outside the floated wheel assembly), the Polaris model 
25 IRIG became the Apollo IRIG. Because the philosophy of the Apollo Program was to 
build on existing technology if it were adequate, no reason to suspect a problem in 
adapting the Polaris wheel package was apparent. In fact, the Apollo Block I gyro- 
scopes used the same wheel- assembly line as the Polaris line, with mixed parts. 

The wheel time ej^ected to accrue before launch was 2000 hours for the early flights 
and 1200 hours for later flights. These estimates proved to be approximately 40 per- 
cent low. No data were available on Polaris instruments relative to useful life. Al- 
though the basic failure rate with time for the Polaris wheel seemed adequate for the 
Apollo application, the basic difference in operating time was not appreciated. This 
dramatic difference is illustrated in figure 14. 

The flight operational techniques of the Apollo Program have required constant 
IRIG wheel operation, which amounts to more than 200 hours on the design- ref erence 


45 


lunar landing missions. Little engineer- 
ing effort or management concern was 
spent on the IRIG bearing during the first 
years of the Apollo Program because the 
inadequacy of the design for the applica- 
tion simply was not recognized. In fact, 
experience was thought to have demon- 
strated the adequacy of the design for in- 
flight reliability. The effect of the low 
average wheel life on the ground prelaunch- 
checkout logistics was not appreciated. 



Gyro life, months 


At the G&N program management 

level, the cost of bearing hainlware has Figure 14. - Inertial reference integrat- 

never been a significant limitation. Un- ing gyro operating hours as a func- 

fortunately, cost probably has been a lim- tion of months, 
itation for the vendors. Of course, cost 
alone cannot yield better bearings when the 

desirable elements of the product are uncertain. During the Apollo Program, vendor 
cost per bearing set has ranged from a few hundred dollars to almost $1000. That fig- 
ure, with a typical 20-percent yield, results in a cost of as much as $5000 per deliv- 
ered gyro. Those involved in vendor process efforts were aware of these facts and 
made efforts to "improve" bearing specifications in both geometrical tolerances and 
visual criteria. From 1962 until the time of publication of this report, more than $20 
million has been spent on the Apollo IRIG, and the high failure rate of the bearing as- 
sembly has been the leading gyro problem. 


CONTRACT HISTORY 


A significant contributing element to the expense and difficulty in solving the gyro 
problems was related to the method of contracting and defining contractors’ responsi- 
bilities. The PGNCS development contractor was given the design responsibility while 
as many as four different organizations, including the development contractor, were 
attempting to manufacture the gyro to the designer’s specifications at one time in the 
Apollo Program. 

The initial Block I Apollo gyro procurement was a single- source, competitive 
procurement for 70 instruments and was awarded to contractor A on a cost-plus-fixed- 
fee basis. Follow-on procurement for groups of 30 and 24 instruments was contracted 
on a sole- source basis by modification of the existing contract. 

During the Block I procurement, it became evident that a dual competitive source 
would have been desirable. Considerable discussion was held at MSC regarding estab- 
lishing a dual competitive source for the Block II procurement. Primarily because of 
the cost consideration, contractor A was selected to manufacture a total of 300 Block n 
instruments on a cost-plus- incentive-fee contract. The delivery and performance in- 
centives were poorly balanced; thus, it always was in the contractor’s interest to seek 
waivers on "out of specification" instruments rather than correct them. Later, the 
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end-item total was reduced from 300 units to 235 units. In the spring of 1967, the high 
failure rate on Block n gyros made the need for a repair program or for additional pro- 
curement evident. In June 1967, a fixed-fee supplement to the basic Apollo contract 
was issued for the repair of failed units that did not lequire disassembly below the 
float level. In February 1968, another supplement was made on a sole- source basis to 
contractor A to include the repair of all failures as required to support the contract 
plus 10 units. 

By late 1967, the production yields were at zero at contractor A facilities and 
issues were developing with the development contractor regarding whether the design 
were buildable or the manufacturer were controlling his progress. The development 
contractor offered to prove they were buildable by manufacturing some in-house. 

A contract was awarded to the development contractor for 40 instruments. A 
competitive subcontract was eventually awarded to contractor B for 32 of the 40 instru- 
ments on a cost-plus- incentive-fee basis by the development contractor. 

By 1969, the bearing yields at contractors A and B and the development contractor 
were almost zero. A competitive fixed-price contract was issued to contractor C for 
the procurement of 25 IRIG units and included a design and qualification responsibility 
for the' bearing package. In March 1972, an option was exercised for an additional 15 
IRIG units. The last unit was delivered in February 1973. 


DESIGN DESCRIPTION 


The Apollo gyro was procured in two basic configurations: the Apollo I IRIG, 
which was used in the Block I G&N system, and the Apollo n IRIG, which was used in 
the Block II CM and LM lunar mission configurations. 

Apollo I IRIG 

The Apollo I IRIG is a single-degree-of-freedom, floated, integrating gyro. The 
wheel assembly is supported by a pair of preloaded, angular- contact (R-2 size) ball 
bearings, adjusted to achieve an isoelastic structure having equal compliance along the 
spin and output axes. The wheel assembly is driven by a two- phase, synchronous, hys- 
teresis motor of 28 volts at 800 hertz. The wheel is enclosed in a sealed, spherical 
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beryllium float. The float pressure is internally maintained at 50 663 N/m (0.5 atmos- 
phere) of helium, which provides good heat transfer and reduces wheel windage torques. 
The Polaris Mark n and Apollo I float assemblies are identical. 

The float is suspended in a brominated fluorocarbon fluid, which provides flota- 
tion and damping. The fluid is fractionally distilled to yield a narrow- cut blend of ap- 
proximately equal viscosities to minimize fluid stratification. 

A ducosyn at each end performs the tasks of magnetic suspension and torque and 
signal generation. The ducosyn is composed of a separate magnetic suspension and 
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transducer microsyn mounted as a single coaxial, coplanar assembly. The potted 
stator assembly is mounted to the case, and two separate rotors are mounted to a sin- 
gle ring at each end of the float assembly. The signal generator is an eight-pole, E- 
connected (centertap, single phase) microsyn at 2- volt, 3200-hertz excitation. The 
torque generator is an eight-pole torquer. Only radial magnetic suspension was pro- 
vided. A normalization package was added to the signal generator end to normalize 
gyro gain and the temperature- sensor output. The package also contained an end- mount 
ring and heater having a slot alined with the input axis of the gyro. The implementation 
of a prealined, normalized instrument greatly simplified IMU assembly and enhanced 
instrument- to- IMU data correlation. 


Apollo II IRIG 

The major changes reflected in the Apollo II instrument were in the ducosyn and 
the normalization assemblies. The Apollo I float assembly was unchanged. The sig- 
nal generator and torque generator microsyns were changed from 8 to 12 poles to re- 
duce residual magnetism caused by pulse torquing. The residuals have an adverse 
effect on bias drift. At the same time, the radial suspension stiffness was increased 
by a factor of 3 and axial suspension was added, both to improve bias stability. A 
bias- compensation winding was also added. The change to the 12- pole torquer intro- 
duced a scale-factor sensitivity to external magnetic fields. The sensitivity was large 
enough to require Mu Metal shielding of the torque generator. Signal generator exci- 
tation was increased to 4 volts. The printed circuit bond was redesigned, suspension 
capacitors were repackaged, bias compensation was added, and a preamplifier was 
added to the gyro prealined assembly. Figure 15 is a cutaway illustration showing the 
main features of the shrouded gyro. 


FAILURE HISTORY AND FAILURE SUMMARY 


Although specifications were written for all levels of testing, failures were not 
measured solely by specifications. All significant parameter data on units from com- 
ponent incoming and acceptance tests through all system- and spacecraft- level testing 
were collected through a reporting system and converted to punchcards and magnetic 
tape in formats suitable for data processing and printing. Monthly inventory listings 
and data summaries were distributed to cognizant persons. Determining failures was 
usually a process of data review by responsible parties, and failure was assessed when- 
ever data indicated one or more of the following. 

1. Performance unacceptable for the mission 

2. Significant wheel- bearing degradation 

3. Unexplainable behavior that could not be demonstrated to result from a known 
and acceptable cause 

4. Indication of float restriction or hangup 
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Figure 15. - Generalized pictorial schematic of Apollo II IRIG. 


In figure 16, the probability boundaries for a successful mission are shown as a 
function of gyro performance. It should be noted that a 20-meru null bias drift (NBD) 
and a 200-meru acceleration drift along input axis (ADIA) are the outer bounds for a 
successful mission. These performance levels are far outside the operating character- 
istics of a properly functioning instrument. 

At the factory, failure judgment was based on drift performance parameters and 
substantiated by other data intrinsic to the type of failure. Bearing failures, for exam- 
ple, would require rundown time, differential wheel power, and perhaps retainer beat- 
frequency data to substantiate failure as indicated by ADIA stability. All indications of 
float restriction were verified by special tests specifically designed to detect such re- 
striction. In the field, evaluations were based primarily and more subjectively on 
drift performance data. Other failure criteria, such as the Delta 25 criterion by which 
a wheel failure was assessed whenever a level shift in ADIA greater than 25 meru was 
experienced, were also used. 
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Figure 17 is a failure summary for 
the Apollo I and II gyros. The Apollo I 
data are for bearing failures only, because 
such failures comprise the bulk of the 
failed units. Approximately 45 of the first 
failures (102 total failures) were due to 
float restriction. This mode of failure 
tended to be predominant and detectable 
relatively early in the IRIG life. In addi- 
tion to the high incidence of float-freedom 
failure in the Apollo II instruments, the 
bearing failure rate was 25 times that of 
the Apollo I units. Although many possi- 
bilities could be offered to explain the dif- 
ferences, the following are considered 
most significant. 

1. For the Apollo I gyro, no specif- 
ic sensitive float-freedom testing was per- 
formed at the gyro or system level after 
gyro delivery. 

2. For the Apollo n gyros, no vis- 
ual inspection of the bearing was made af- 
ter run-in because run-in was performed 
in the float rather than in a dynamometer. 

Finally, wheel performance of the Apollo 
II gyros was categorically worse than that 
of the Apollo I gyros, although both were 
within specification. (See the subsequent 
section entitled "Bearings. ") 


PROGRAM PROBLEMS 


The two major problems of the pro- 
gram were float- cavity contamination and 
wheel- bearing failure. These failure 
modes had the most significant production 
effect on gyros and systems and were the 
primary reasons for removal of inertial 
measurement units from spacecraft and 
for initiation of an extensive repair pro- 
gram. 



Figure 16.- Apollo IRIG mission per- 
formance requirements. 
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(b) Apollo II. 

Figure 17.- Gyro bearing failure rate as 
a function of wheel time from assembly. 
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Float Freedom 


Float-freedom failure was the second most common failure mode of the Apollo 
PGNCS. Approximately 60 out of 235 delivered Apollo II gyros failed because of float 
restriction. After concerted effort, float-freedom failures or evidences of contamina- 
tion were largely eliminated during the last year (December 1968 to December 1969) 
of the repair program. Progress was made slowly and in stages. When the repair 
program started in early 1967, the contractor attempted to defend the contamination 
level and the incurred failure rates as representing the state of the art. By comparing 
the production float-freedom-test failure rates of manufacturers involved in the Polaris 
Mark n IRIG, it was shown that an order of magnitude improvement was achievable. 

To maintain progress on the problem during the repair program, the following 
actions were taken. 

1. All defective units, regardless of cause of failure, were carefully scruti- 
nized for particle contamination. The quantity and size of particles found were noted. 

2. A weighted contamination counting system was developed. The model was 
based on the weighted volumes of the four damping- gap sizes characteristic of the 
model 25 IRIG and the number of particles with major dimensions exceeding the respec- 
tive gap sizes. 

3. Tabular summaries of contamination findings, grades, and related details 
were kept, and correlation was attempted. The distribution of contamination grades 
was also examined. 

The results of these efforts were that no distribution pattern was evident and no corre- 
lation with event, time, personnel, or other detail could be established. It was con- 
cluded that contamination resulted from uncontrolled process events. 

In late 1968, contractor A implemented the following six-point program. 

1. Improved Inspection microscopy was incorporated. This step involved the 
use of better microscopes having good depth of field and dark background lighting or 
shajding to enhance the perception of light- colored or relatively transparent particles. 

2. The final assembly process was minimized. The number of assemblies or 
piece parts that went to final assembly was minimized by doing as much as possible 
at lower levels and even by redundant final assembly operations, where necessary. 

3. A flush- and-filter- until- clean operation was incorporated on al-1 items going 
to final assembly. Cleanliness was determined by filter analysis of the flushing medium 
and by microscopic inspection. 

4. Blue filtering of the flushing medium was added to the existing white filtering 
because it had been shown that, as a result of insufficient contrast, the white filters 
would not show light- colored contamination. 
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5. The gyro-fill overflow was analyzed for contamination. The presence of any 
particles larger than 75 micrometers was cause for assembly rejection. 

6. Intensive personnel training programs designed to teach processes and tech- 
niques and to instill an extreme contamination consciousness were incorporated. 

After full incorporation of these points, production and system float-freedom failures 
were practically eliminated. 

Contractor C implemented the same basic contamination control procedures. The 
MSC engineering and quality control personnel established a priority for this area and 
finally approved the contamination control efforts. Experience has shown the extensive 
efforts to be extremely successful. 


Bearings 

The Apollo Program was started with the same bearing metal used in the Polaris 
gyro, and torque was monitored by dynamometer for a 50- hour run-in period followed 
by float assembly and a brief 1- to 2- hour milliwatt evaluation (fig. 18). The Apollo 
Block I basic wheel package, incorporating minor changes outside the float, was used 
for the Apollo Block n IRIG build program. However, the 50- hour dynamometer screen 
was replaced by a direct build of the wheel into a float, and the milliwatt power trace 
for a 50- hour screen was used (fig. 18). This procedure was followed to reduce the 
possibility of contamination of the screened wheel in the float assembly and to ensure 
that the screening was done in the final running environment. 




(a) Block I. 


(b) Block II. 


Figure 18.- Gyro test sequence. 


Soon after the Block II gyroscope production was completed, it became evident 
that wheel failure rates would require an extensive repair program. An experience of 
8000 to 9000 hours calculated mean time between failures on the Block I gyros de- 
creased to 3000 to 4000 hours for the Block II gyros. A multifold bearing- improvement 
program was initiated in late 1967 with the beginning of the repair program. This ef- 
fort included four areas; (1) a smoother (double honed) metal finish on the bearings; 

(2) a sintered nylon (Nylasint) retainer that was impregnated to the upper limit of the 
specification and that would yield a larger quantity of oil; (3) a more complex cleaning 
process to aid oil-film retention by the metal; and (4) a longer, more intensive run-in 
screen evaluation. It was hoped that the smoother metal and the better cleaning process 
would improve assembly yields; however, the added oil-handling capability and the more 
rigorous screening procedure were aimed at attaining longer life. 
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Of course, all deviations from the Block 1 configuration were suspect. The first 
potential problem area eliminated was that of the retainer; however, trial builds with 
the Block I Synthane retainers also resulted in failures in the first hours of dynamom- 
eter monitoring. Next, the surface film developed with the new cleaning technique be- 
came suspect. Although the impossibility of measuring a surface film or inspecting 
for the absence of a surface film delayed and clouded test results, no improvements 
from zero yields were demonstrated % using any of the cleaning methods on available 
metals. Cleaning agents used included caustic solutions, detergents, and all common 
solvents that were well- mixed, vacuum dried, and stirred by ultrasonic means. 

On a longer duration time scale, the condition of the surface finish of the races 
was investigated. The goal of this task was to return to Polaris/Apollo Block I surface- 
finish characteristics. Scanning electron microscope and replication studies were made 
of the double- honed metal. 

As in all phases of the Apollo Program, documentation on the gyroscope bearing 
was thorough. However, none of the finishing processes used on the bearing were 
shown on Apollo drawings. The critical processes were identified, and the vendors 
kept these documents in bonded files. A review of the bonded files of both major ven- 
dors did not allow a duplication of the finishes found in the Apollo Block I IRIG program. 
The major delay in studies of raceway-finishing techniques was the lack of any evalua- 
tion (other than successful bearing assembly run experience) or inspection tools that 
could be used to determine quickly the presence of asperities and lapping compounds of 
several micrometers. The use of a scanning electron microscope and an interference 
microscope by a bearing vendor provided these necessary tools. With these tools, 
processes can be better controlled to ensure that metal cutting has been effected on 
each successive stage, that lapping material has been removed, and that the surface 
effect of the previous process has been eliminated. The timing of the Apollo Program 
was such, however, that the resulting metal could not be obtained expeditiously. 

While the long-term bearing metal studies were proceeding, program commit- 
ment required support within a shorter timespan. Because only hardware giving zero 
or very low yields was available, two approaches were taken to use the metal available. 
One approach was to change the bearing design so that less stress would be placed on 
the metal as it existed, and a second approach was to refinish the metal by a metal- 
removing process to improve the surface characteristics. 

An alternative method, capable of improving yields and of extending bearing life 
and performable within the time available to support the Apollo production effort, was 
to increase the oil-film thickness. It has been demonstrated repeatedly that bearing 
life is affected by the relationship of film thickness to the sum of rolling- surface fin- 
ishes. Because previous efforts had been made to improve the surface finish, it 
seemed reasonable to consider increasing the oil-film thickness. 

The most viscous commercial basic- bright- stock lubricant was selected, to which 
was added 1 percent oxidation inhibitor to ensure long life and 3 percent tricresyl phos- 
phate as a mild extreme-pressure additive. This oil was termed N-3. Tests on four 
bearings showed a running life of 200 to 300 hours before visually detectable tracks 
were developed on the raceway. The same hardware lubricated with standard V-78 oil 
had been limited to a running time of less than 16 hours before burn tracks appeared. 
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Although time was too limited to develop life- test data before making commitments, 
this quick burn-track evaluation did give a valuable indication that a definite operational 
margin improvement would be obtained by lubricant change alone. Nevertheless, wheth- 
er this evaluation was sufficient for the program was a matter of concern. 

Because the quantity of oil in the contact area would always be marginal without 
significant bearing design changes, more effective ways of developing films were con- 
sidered with such changes. In discussions with A. Cameron and D. Dawson of Leeds 
University, London, England, the significance of the inlet- throat meniscus dimensions 
was emphasized. Then, it followed that, if the meniscus dimension could not be in- 
creased, the Hertzian area could be decreased in an attempt to reduce the starvation. 
After much analysis and discussion, 0. 36 to 0. 45 kilogram (0. 8 to 1 pound) was selected 
as a nominal static preload instead of the 1. 36-kilogram (3 pound) preload that was used 
previously. This hypothesis has been demonstrated by film thickness measurements 
made in a running bearing. 

In mid- 1969, the most promising of the changes were combined and incorporated 
as a group. Because bearing manufacturers had not been able to produce metal that 
was equivalent to that used in the Block I program, improved polishing and refinishing 
techniques were used on existing metal. This metal was combined with an inner- race- 
riding Nylasint retainer that had a slightly higher percentage of a three- times- more 
viscous oil and was assembled with a 0. 36- to 0. 45- kilogram (0. 8 to 1 pound) nominal 
preload. To increase the effectiveness of the run-in screen, off-nominal running con- 
ditions were introduced. A low- temperature run at 325 K (125° F) and a high- 
temperature run at 344 K (160° F) were incorporated before the 200-hour dynamometer 
screen at 331 K (137° F). The low-temperature run was designed to increase the vis- 
cous drag of the oil and to determine whether the retainer was stable marginally. The 
high- temperature run, which also was incorporated to determine the retainer stability, 
reduced the potential oil-film thickness to near that of V- 78 oil. In all evaluations of 
metal process changes, the 1. 3 6- kilogram (3 pound) preload, V-78 oil configuration 
was used to provide quick evaluation of the effectiveness of the change. 

The total resulting screening test is summarized in figure 19. Metal yields of 
zero at the beginning were increased to a working 10 to 15 percent when only the metal 
reworking was incorporated and to more than 50 percent when heavy-oil/low-preload 
changes were added. 



(a) Original. (b) Current. 

Figure 19. - Gyro test sequence, Block II repair and replacement. 
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Normalization Circuit Board 


Numerous problems were encountered with the printed circuit board and harness 
used in the gyro normalization assembly, including the following. 

1. Improper harness layout causing insulation cold flow over pins and sharp 

edges 

2. Cracked and cold solder joints 

3. Connector-pin solder failures caused by rigidly soldering floated connector 
pins to the circuit board 

The problems caused numerous removals of gyros from inertial measurement units 
for Inspection, rework, and retrofit. Good product- design review might have averted 
many of these problems. 


Gravity Transient 

The occurrence of gravity transients was due to entrapment of damping fluid in 
a nonvented annulus around the gyro output axis. The annulus resulted from a machin- 
ing relief on the rotor holder. When the rotor was assembled and cemented to the hold- 
er, cement would partially fill the annulus in random geometric patterns. These ce- 
ment blockages prevented the annulus from being properly filled with fluid during gyro 
fill. Later, seepage under operating pressures would either fill small cavities in the 
annulus to cause mass shifts or would partially fill a cavity to cause an unstable mass 
distribution. This seepage caused a g- sensitive drift for a relatively short time when 
the gyro was repositioned during testing. The problem was avoided by careful develop- 
ment and application of the cement. 


Hot Storage Sensitivity 

Hot storage sensitivity is believed to have resulted from seepage of damping 
fluid into the small cement voids in the rotors. This seepage creates a g- sensitive 
drift similar to the gravity- transient condition, but for a much longer time. A signif- 
icant problem existed in the contractor B IRIG units. Polaris IRIG units still have this 
problem to some degree. Contractor C incorporated a high-pressure impregnation on 
the rotors in an effort to preclude hot storage sensitivity; this procedure apparently 
succeeded because hot storage sensitivity has not occurred in contractor C IRIG units. 


Tolerance Problems 

other problems were encountered because of inadequate design review of worst- 
case tolerance combinations. Problems caused by this deficiency included the following. 

1. Suspension hangup; Excessive end shake along the gyro output axis allowed 
float corner positions that were unstable and from which the magnetic suspension would 
not recenter. 
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2. Alinement problems: Worst- case tolerance combinations between end hous- 
ings and end- cover trunnions prevented adequate grip to maintain alinement. The same 
type of situation existed between the end- cover trunnion and the end- mount heater. 


Field Sensitivity 

The initial Apollo II gyros showed an extreme torquer- scale-factor sensitivity to 
external magnetic fields. This sensitivity was cured by changing the torque generator 
end- cover material to Mu Metal. 

Workmanship Problems 

The forward production and early repair program included a constant stream of 
workmanship and production- error problems. An improvement program with the fol- 
lowing features was implemented. 

1. Organizational merging of all engineering functions to eliminate diverse 
responsibilities 

2. Generation of new gyro- build documentation to a usable format (Previous 
documentation involved so much descriptive material and so much cross-referencing 
that it was impractical to use. ) 

3. Gross improvement in the quality of build documentation and process controls 

4. Enforcement of the control and use of build documents (Previous practices 
allowed many different persons to make redline changes to build documents with no cen- 
tral control authority. Quality control also required that build documentation be kept 
current. ) 

5. Implementation of a tight failure- analysis/corrective- action loop 

6. Gross improvement in the management and discipline of failure- analysis 
functions 

7. Motivation and discipline of technicians to ensure consistency and control 

After implementation of these improvements, a well- controlled program evolved and 
workmanship problems were virtually eliminated. 


PULSED INTEGRATING PENDULOUS' ACCELEROIVIETER 


Three pulsed integrating pendulous accelerometers are used in the Apollo IMU 
in an orthogonal set to sense acceleration in any direction. The PIPA consists of an 
unbalanced float with attached ferrite rotors, high- viscosity damping fluid, a signal 
generator, a torque generator, a main housing, and a suspension module together with 
associated electronics and calibration modules. 
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With zero acceleration, the float is constantly torqued three pulses in one direc- 
tion and then three pulses in the other direction. This process is called "3:3 moding. " 
Accelerations of the IMU resulting from forces or applied thrusts create torques on 
the unbalanced float. These torques are summed by the float with those caused by the 
3:3 moding. A signal is sent to the electronics module, which determines the direc- 
tion of rotation and generates equal but opposite torque signals. These signals are sent 
to the torque generator, which drives the float back within the limit- cycle threshold. 

The computer receives the difference in plus and minus torque commands proportional 
to a change in spacecraft velocity and uses the signals as data to compute spacecraft 
trajectory information. 


DEVELOPMENT HI STORY 


This discussion of the PIPA development history includes the results of a repair 
program and of a comprehensive performance data analysis. 

Conceptual Phase 

The Polaris Mark II inertial system design was selected for the Apollo spacecraft. 
The selection of the accelerometer was limited to a device that would be compatible 
with the Polaris system design and also meet the Apollo requirements. Because no 
existing accelerometer completely met both requirements, the Polaris model D, size 
16, PIP was selected on the basis of compatibility, simplicity, reliability, and ease of 
modification. 

Two initial modifications were made to the accelerometer. Reduction of the pen- 
dulous mass from 1 gram- centimeter to 0. 25 gram- centimeter increased the acceler- 
ation range from 4g to 16g, and tapering of the ducosyn rotors to provide magnetic sus- 
pension axially as well as radially improved the scale-factor stability from 1000 parts 
per million (ppm) to within 100 ppm. 

A contract was awarded in June 1962 to produce the initial 72 PIPA units. To 
minimize the delivery time for the first few units, the contractor modified some avail- 
able Polaris subassemblies and the PGNCS development contractor supplied some ma- 
jor hardware items. The first six Block I (0) units were delivered in October 1962. 
Acceptance testing was performed at the PGNCS development contractor because the 
contractor did not have operational Apollo acceptance test equipment at that time. 


Block I Definition 

The first 19 Block I units, which incorporated a torquer reset coil, were delivered 
in February 1963. Acceptance testing was performed at the contractor facility starting 
with unit 1A21. The design of the torquing loop was changed from ternary to binary in 
March 1963 because the testing of Block I (0) PIPA units revealed that residual magnetic 
effects caused large bias variations. These variations were determined to be dependent 
on the polarity and frequency of the ternary pulses, and the design change to continuous 
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alternate binary torquing neutralized or averaged these effects. A reliability test pro- 
gram initiated in May 1963 consisted of a bellows evaluation, a PIP performance eval- 
uation, and a suspension module qualification. The bellows evaluation was completed 
in July 1965; the results showed that both the nickel bellows and the silver antimony 
bellows exhibited cycle life, spring rate, and volume compensation adequate for normal 
PIP operation. Subsequent experience has indicated a requirement to place emphasis 
on quality control in bellows manufacture and on inspection by X- ray examination of the 
assembled instrument. The performance evaluation and suspension qualification test 
programs were terminated in November 1965 with a technical decision that all useful 
data had been extracted. 


Block 1 1 Definition 

In September 1963, the PIP assembly design was changed to include an end heater, 
a suspension module, and a plug-in cable. A major cause of bias changes was elimi- 
nated by moving the torque generator from the inboard end, which contained the mount- 
ing arrangement, to the outboard end. This relocation eliminated a major source of 
bias changes by removing the nonsymmetrical stresses on the torquer caused by clamp- 
ing pressures during the alinement of the unit to the stable member. 

A contract was awarded in June 1964 for the manufacture of 200 Block II PIP 
units. Process changes to the alinement- ring machining operations were initiated to 
ensure limited dimensional variations at each step for achieving an alinement capabil- 
ity of 10" of arc. A failure- analysis/corrective- action program was initiated in Decem- 
ber 1965 by teardown and analysis of the first group of 14 PIPA units. This program 
revealed many defects (contamination sources, voids in cement, and wiring discrep- 
ancies) that were significant to unexplained failure modes and that contributed to follow- 
on design changes. 

An additional 49 Block II PIP units were added to the contract in early 1966. 

These units incorporated the latest assembly processes, float sealing techniques, X- 
ray inspection of bellows, and packaging of the suspension module as shown in figure 20. 


Repair Program 

In the early part of 1967, the failure rates together with the program length re- 
quired an additional 50 instruments. An analysis of failure modes dictated that im- 
provements in the float sealing operation, the bellows quality control, and the final 
instrument seal were necessary to decrease the amount of air entering the damping 
fluid. Sample instruments were built and tested using new techniques and processes. 

A PIP repair contract was awarded in December 1967 for 50 units. The con- 
tract called for harness and suspension module repair on 10 units and a complete tear- 
down and rebuilding of 40 units, using the new manufacturing techniques in bellows, 
float, and housing seals. 

In the final configuration released in June 1968, the redesigned housing and as- 
sembly procedures provided the final instrument seal. Basically, the instrument 
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formerly had been assembled within a con- 
tainer of damping fluid with an 0-ring pro- 
viding the final seal and with no method of 
checking this seal. In the new design, the 
instrument was assembled dry with a 
cement- band seal taking the place of the O- 

-9 3 

ring, leak- checked to 1 x 10 cm /sec, 
and then filled with damping fluid through 
portholes in the end. Delivery of the re- 
paired units was completed in May 1969; 

44 internally repaired imits and 7 exter- 
nally repaired units were delivered for a 
total of 51. 

Data Analysis 

A comprehensive analysis of PIPA 
data obtained from the Apollo Block II in- 
strument population was completed in Sep- 
tember 1968 with the following results. 

1. At least 94 percent of all scale-factor and bias measurements were within 
Apollo system specification. 

2. Turn-on, turn-off, and random "gaussing" represent data points outside the 
system specification and are uncorrelated with the main body of data. System perform- 
ance data analysis should, therefore, not consider these data points. 

3. IMU axis assignment does not affect performance. 

4. The vibration environment does not affect scale-factor or bias stabilities. 


RESOLVED PROBLEMS 


Suspension 

module 



Alinement 
rings' 


Figure 20.- Model D, size 16, pulsed 
integrating pendulum. 


The following problems were investigated and solved. 

1. Several heater/sensor circuit failures occurred in Block I units. As a result, 
strain loops on the sensor wire and pull tests on the harness were introduced for the 
Block II units. 

2. Impurities were found in the damping fluid in Block I units. Reduction in the 
use of Tygon plastic tubing and changes in the filtering processes eliminated this 
problem. 

3. Many of the thin- wall connectors located on the suspension module were found 
to be cracked or chipped. The connectors were encased in potting material to prevent 
cracking and chipping. 
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4, Several early Block II units were found to have fluid within the hollow float 
that caused variations in the float pendulosity and resulted in large and unstable changes 
in scale factor. The cause was traced to voids in the cement used to seal the float. 
Changes were made in the cementing processes, and a more viscous cement was intro- 
duced. 


5. A small shift in input- axis alinement was observed in early Block n units. The 
cause was determined to be small voids behind the rotors that were partly filled with damp- 
ing fluid. The damping fluid moved as a function of the instrument position and caused 
small pendulosity changes. The cementingtechnique was changed to alleviate this effect. 

6. Many Block I and Block II units were found to have gas bubbles in the damping 
fluid, a condition that caused unstable bias. Three areas of gas leakage were suspect: 
(1) the gas-filled bellows, (2) the float assembly, and (3) the 0-ring external seal. 
Improved bellows and float assembly leak checks were incorporated in the manufactur- 
ing process. When the repair program was initiated, a cemented bond was used in- 
stead of the 0-ring. The outside seal as well as the bellows and float seals then were 
leak- checked. The instrument was then filled through small portholes in the end hous- 
ing, after which the portholes were sealed with metallic compression seals. 


CONCLUDING REMARKS 


Conclusions and recommendations are presented by subsystem and component to 
reflect the individual coverage given the basic elements of the primary guidance, navi- 
gation, and control system in this report. 


INERTIAL SUBSYSTEM 


It appears that the schedule push early in the Apollo Program (i, e. , fly by late 
1963) may very well have led to inadequate systems review before designs were frozen. 
Within the inertial subsystem, however, the conservative design decisions in most 
cases were very close to optimum. Use of the Polaris technology certainly reduced 
the risk and effort required for most elements of the inertial subsystem design. Un- 
realistic workloads required of the crewmen in maintenance, fault isolation, mode se- 
lections, and operational techniques were the primary mistakes corrected in the change 
from Block I to Block II configurations. 

COMPUTER SUBSYSTEM 


The Apollo guidance computer has proven its capabilities, and spacecraft for fu- 
ture deep-space flights will probably use similar or larger onboard general-purpose 
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digital computers. In the development of future designs requiring additional sophisti- 
cation, consideration should be focused on modernization of displays, the use of solid- 
state switching devices, and the use of higher levels of integration in logic circuitry. 
Further recommendations for future programs are as follows. 

1. The specification control drawings for parts should Include application infor- 
mation. 

2. Computer design should include an isolated power supply to prevent noise 
susceptibility. 

3. The number of components should be kept to a minimum; that is, one logic 
circuit type should be used to perform all logic operations. 

4. Maximum use should be made of wire wrap for module interconnections. 

This connection has proved to be highly reliable. 


OPTICAL SUBSYSTEM 


A review of the Apollo missions shows that both the optical unit assembly and the 
alinement optical telescope performed the intended functions in a most satisfactory 
manner. The design, testing, and fabrication were well planned and adequate for the 
mission use of the two optical subsystems. This was further indicated by the use of 
the Apollo hardware long past the intended time frame. 

The later equipment modifications were largely the result of a natural evolution- 
ary process as requirements were better defined by actual mission applications. The 
overall performance of the optical subsystem can be considered more than adequate in 
function and outstanding in reliability. 

Any recommendations for improvement would have to include better coordinated 
design functions and additional worst- case testing to ensure detection of equipment 
anomalies during extreme environmental conditions. More attention should be given 
to items that are considered to have limited lifetimes. Examples of problems that 
could have been corrected by early design changes or identified as limited- life areas 
are as follows. 

1. Eyepiece fogging of the scanning telescope: Visual observations during envi- 
ronmental testing would have shown the need for a larger heater to prevent fogging of 
the scanning telescope eyepiece. 

2. Refurbishment of the optical unit assembly: The beryllium corrosion passiva- 
tion process and the motor- tachometer lubrication changes were successful only after 
the mistakes made during the first program to correct the same initial design deficien- 
cies had been corrected. Refurbishment of the optical unit base assembly is an excel- 
lent example of the criticality of limited- life items. 
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3. Internal harness connector springs of the optical unit assembly: The optical 
unit assembly internal harness connector was an area in which a little design effort to 
prevent breakage of spring contacts would have precluded the need for a major retrofit 
This problem is an ideal example of both design deficiencies and limited life. 


INERTIAL REFERENCE INTEGRATING GYRO 


The high- viscosity- oil changes made in 1969 produced higher bearing metal 
yields and more reliable gyro wheel assemblies than any previously produced in the 
Apollo Program. Other programs such as Polaris and some of the ball bearing manu- 
facturers are incorporating this Apollo- originated basic configuration when operating 
conditions permit. 

At the end of the Apollo gyro production effort, an advancement that is near 
accomplishment is bringing metal finishes of high integrity together in a configuration 
that develops an oil film several times thicker than the asperities and inclusions on the 
bearing surface. This achievement has been substantiated by direct film measure- 
ments. 

Apollo experience has shown the importance of constantly improving processes in 
which the yields are low. Constant attention to fundamental elements of the design is 
necessary to provide basic design margins when possible. This method is preferred 
over attempts to optimize marginal processes. 

Ball bearing designs for future instruments should be directed toward establish- 
ing large design margins and demonstrating them. The tools that can be used to accom- 
plish this goal are advanced measurement techniques, qualification of bearing hard- 
ware, and the understanding of basic elastohydrodynamic theory. The extensive con- 
tamination control efforts together with the incorporation of an assembly- rejection fil- 
ter criterion have practically eliminated the once major problem of float restriction. 

The NASA Lyndon B. Johnson Space Center (formerly the Manned Spacecraft 
Center) was involved in a much closer and detailed control of the production program 
of the final contractor (contractor C) of the inertial reference integrating gyro. Even 
small Class n changes required Manned Spacecraft Center concurrence. Very close 
control is extremely important for obtaining consistently good gyros. 


PULSED INTEGRATING PENDULOUS ACCELEROMETER 


The performance of the pulsed integrating pendulous accelerometer has actually 
exceeded that required for the Apollo Program. In retrospect, consideration given to 
alternate simpler accelerometers early in the program could have saved money and 
system test time. The large number of magnetic suspension problems that occurred 
might have been smaller if the pendulous mass had been reduced by a factor of 2 rather 
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than 4. This reduction would have provided an acceleration range of 8g, which would 
have been adequate for the Apollo mission requirements. The bubble problems and 
contamination of the fluid could have been reduced earlier by initial X- ray screening 
and by exercising more care in cleanliness control. 

It should be emphasized, however, that the pulsed integrating pendulous acceler- 
ometer proved satisfactory for performing the Apollo mission as is evidenced in the 
analysis of both flight and test data. 


Lyndon B. Johnson Space Center 

National Aeronautics and Space Administration 
Houston, Texas, February 12, 1976 
961-21-31-89-72 
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